Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects execution of mshta.exe with command line arguments containing web-related indicators (http) or scripting engines (vbscript, javascript). This behavior is characteristic of adversaries using mshta.exe as a proxy to execute remote malicious payloads or inline scripts, effectively bypassing application controls and browser security contexts.
Detects the spawning of common command-line or script execution shells (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe) by the Windows Remote Management (WinRM) provider host (wsmprovhost.exe). This behavior is often indicative of remote code execution or lateral movement via WinRM.
Detects the execution of rundll32.exe with command-line arguments typically used for proxy execution of scripts or malicious DLL functions (javascript:, vbscript:, ShellExec_RunDLL, LaunchINFSection), which is a common technique used by attackers to bypass security controls and execute arbitrary code, excluding instances involving comsvcs.dll.
Detects PowerShell execution patterns used for host reconnaissance and application enumeration, specifically looking for combinations of Get-StartApps and Get-AppxPackage with silent error handling. This behavior was observed in the easy-day-js malware dropped via the Mastra npm supply chain compromise.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
This rule detects when the Windows Subsystem for Linux (WSL) process (wsl.exe) launches common Windows binaries or scripting engines. This behavior is indicative of potential cross-environment execution, where attackers use the Linux subsystem to bypass Windows-based security controls or to execute malicious payloads, living-off-the-land techniques, or command-and-control activities within the Windows environment.
Detects a suspicious file deletion event where a JSE script is deleted from the Downloads directory by wscript.exe or cscript.exe. This activity is indicative of the Kimsuky threat group's NUKESPED dropper cleaning up its own artifact after execution to avoid forensic detection.
Detects the execution of PowerShell via WScript or CScript (WshShell.Run) with hidden window flags, involving the use of 'certutil' to decode a staged payload located in a ProgramData directory. This pattern is characteristic of Kimsuky loader activity.
Detects the Kimsuky threat group using a JSE-based loader to write decoded binary payloads to the C:\ProgramData directory. The files are written using randomized filenames with specific non-standard extensions (.a9oc, .lpXD, .lpxQ, .lpXO) initiated by wscript.exe or cscript.exe, a technique observed in their January 2026 campaign.
Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.
This rule detects suspicious process execution chains associated with known Kimsuky campaign activity and NUKESPED malware. It identifies the execution of the NUKESPED secondary payload 'zlrenu8.exe' and a specific sandbox-evading JSE loader chain where WScript or CScript spawns hidden PowerShell instances using 'certutil' to decode files stored in the ProgramData directory.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
Detects the execution of batch scripts that invoke file transfer utilities (certutil, bitsadmin, or powershell) to download components into temporary directories, a behavior associated with the Red Lamassu campaign.
Detects the Kimsuky NUKESPED JSE loader anti-analysis pattern. The rule monitors for wscript.exe executing a JSE file, followed by a delayed PowerShell execution containing hidden window flags, decoding or non-interactive flags, and references to ProgramData, which is consistent with sandbox evasion and NUKESPED payload staging.
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Detects the execution of WMI queries or hidden PowerShell commands initiated by JScript/VBScript interpreters (wscript.exe/cscript.exe), a behavior characteristic of Kimsuky's NUKESPED loader for performing anti-analysis and sandbox evasion.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects the execution of script files (e.g., .js, .jse, .vbs) via Windows Script Host (wscript.exe, cscript.exe) where the parent or grandparent process is a known archive extraction utility (e.g., 7zip, WinRAR). The rule further filters by identifying keywords associated with malicious lures (e.g., 'health', 'medical', 'nhis'). This behavior is commonly associated with phishing campaigns delivering malicious attachments.
Detects instances where script interpreters (wscript/cscript on Windows; sh/bash/busybox on Linux) are used to spawn command-line tools (cmd.exe or rm/unlink) to perform file deletion operations. This is a common pattern for attackers to remove evidence, logs, or tools post-execution.
This rule detects when the Python interpreter (python.exe or py.exe) initiates a network connection to an internal or loopback IP address. This behavior can be indicative of a local process scanning the internal network, pivoting, or interacting with locally running services as part of a post-exploitation or reconnaissance activity.
This rule detects when the Python interpreter (python.exe or py.exe) initiates a network connection to an internal or loopback IP address. This behavior can be indicative of a local process scanning the internal network, pivoting, or interacting with locally running services as part of a post-exploitation or reconnaissance activity.
Page 85 of 191