Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Detects common shell and utility processes spawning as children of the AutoGen Studio process, indicating potential remote code execution via the AutoJack exploit chain.
Detects modifications to Registry Run or RunOnce keys that include references to 'ManageEngine' or 'SystemOptimizer' and attempt to execute scripting hosts like wscript, cscript, powershell, or cmd. This behavior is indicative of persistence mechanisms often used by adversaries.
Detects the execution of AutoHotkey or AutoIt automation scripts, particularly when these tools spawn suspicious child processes (e.g., cmd.exe, powershell.exe, wmic.exe), initiate commands from non-standard directories (Temp, AppData, Downloads), or run from locations outside of the standard Program Files installation directory.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects the execution of AutoHotkey or AutoIt automation scripts, particularly when these tools spawn suspicious child processes (e.g., cmd.exe, powershell.exe, wmic.exe), initiate commands from non-standard directories (Temp, AppData, Downloads), or run from locations outside of the standard Program Files installation directory.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
Detects scripts launched from developer directories (e.g., GitHub, GitLab, Bitbucket, or directories containing 'interview' in their path) that attempt to exfiltrate data by making network connections to Discord or Telegram API webhooks. This rule specifically looks for network events where the remote URL matches Discord or Telegram webhook patterns, and correlates them with process events where the initiating process's folder path suggests a developer-related or interview-related context.
This rule detects the creation or execution of files named 'winupdate.exe' and specific patterns of Python script execution within user-writable 'AppData' subdirectories, specifically targeting the '.cache' folder. This behavior is indicative of potential malware staging or execution, often associated with obfuscated payloads or unauthorized software running in non-standard user locations.
Detects the execution of Python interpreters from non-standard or typically user-writable locations (e.g., AppData, Temp, Downloads) or when the command line includes execution of a script file. This rule excludes common development environments to reduce noise, focusing on potentially malicious usage of Python for persistence or execution of staged scripts.
This rule detects potentially malicious Python script execution by monitoring for 'python.exe' or 'pythonw.exe' processes running from suspicious locations such as 'AppData' or 'Temp' directories. It also flags 'python.exe' when it initiates suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe) and alerts on 'pythonw.exe' execution when not initiated by trusted installers.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects Python executing adconnectdump.py, which targets credentials stored by Microsoft Entra Connect. This tool is used to dump credentials from Microsoft Entra Connect (formerly Azure AD Connect) installations.
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
Detects execution of potentially malicious npm lifecycle scripts (preinstall/postinstall) associated with the Polymarket Trap supply chain campaign. The rule monitors node.exe spawning specific known-malicious scripts or executing shell commands via cmd.exe, often related to attacker-controlled dependency packages.
Page 98 of 191