Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects PowerShell-based malware stagers used by ErrTraffic ClickFix campaigns that download and execute second-stage payloads using encoded commands and common download cradles. It also detects certutil.exe used for decoding.
Detects instances where common web browsers (Chrome, Edge, Firefox, IE) act as the parent process for scripting interpreters such as PowerShell or cmd.exe. This behavior is highly irregular for standard browsing activity and is often indicative of malicious code execution, such as a drive-by download or browser exploit triggering secondary payload execution.
Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.
Detects the execution of wscript.exe using VBScript features such as 'FileSystemObject' and 'Shell.Application' to perform directory enumeration. This pattern is commonly observed in malicious scripts used by threat actors, such as Kimsuky, to discover files and system information during the reconnaissance phase of an attack.
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
Detects a suspicious execution chain where 'node-gyp' is observed spawning 'node' to execute 'index.js', characteristic of a 'Phantom Gyp' malicious pattern, followed immediately by the execution of a temporary JavaScript payload via the 'bun' runtime. This pattern is indicative of a multi-stage loader often used in supply chain attacks involving obfuscated payloads.
Detects execution of system discovery and evasion commands commonly used by the Gamaredon group's Ptero-family tooling. The rule monitors for mshta.exe, wscript.exe, or cscript.exe spawning wmic, powershell, or cmd to execute queries related to virtualization artifacts (e.g., VirtualBox, VMware) or time-based evasion (e.g., Start-Sleep).
Detects node-gyp rebuilding a native addon where the binding.gyp file utilizes GYP command expansion to execute index.js. Malicious npm packages often abuse this mechanism to execute arbitrary JavaScript code during the build process, bypassing standard lifecycle script scanners.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Detects the execution of regsvr32.exe with command-line arguments indicative of 'Squiblydoo' style attacks, which use the signed Windows binary to proxy the execution of remote scripts or local COM scriptlets (.sct files). The rule specifically flags the use of /i with HTTP(S) URLs, loading scrobj.dll, or specific combinations of /s /u /i flags to bypass application control mechanisms.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
Page 90 of 191