Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,466 detections
Filters
Last updated
All Time
Detection languages
1,885
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,847
2,671
2,393
1,718
312
Platforms
4,411
153
89
34
21
Products / Services
1,184
1,146
1,042
668
277
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
4,466
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
Hunts for the full SEO poisoning / Phishing chain: User clicks LNK -> Spawns CMD -> Invokes PowerShell.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
This rule detects the spawning of common command-line interpreters, utilities, and scripting engines by a parent process associated with 'autogenstudio'. This behavior is potentially indicative of command injection or exploitation where an AI-driven development environment is leveraged to execute unauthorized system commands or launch malicious payloads.
Detects instances where the AutoGen Studio process, or a process with 'autogenstudio' in its command line, initiates suspicious subprocesses such as command shells (cmd, powershell, bash, sh) or common living-off-the-land binaries (certutil, mshta, rundll32, regsvr32, curl, wget, bitsadmin, python). This behavior is characteristic of an adversary leveraging a potentially vulnerable application to execute arbitrary code on the underlying system.
This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.
Detects instances where the AutoGen Studio AI agent process (python.exe or pythonw.exe) executes shell interpreters like cmd.exe or powershell.exe, typically indicative of Remote Code Execution (RCE) attempts resulting from MCP WebSocket prompt injection or similar vulnerabilities.
Detects the execution of cmd.exe or powershell.exe where the command line contains references to the Avast directory. This behavior may indicate an attempt to tamper with, interact with, or bypass security software components.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using a combination of arguments and commands commonly associated with script obfuscation or file-less execution patterns. This includes the use of ReadAllText for file reading, environment variable manipulation, and common execution aliases (iex/Invoke-Expression) combined with the -nop (NoProfile) flag.
Detects execution of PowerShell commands using WScript.Shell to create shortcuts, specifically looking for indicators related to 'vile_Decryptor.lnk' or 'vile_icon.ico'. This pattern is frequently observed in malware deployment or dropper activities aiming to establish persistence or facilitate user-driven execution.
Detects a suspicious PowerShell execution pattern observed in Pay2Key ransomware, where PowerShell attempts to read and execute the contents of a setup.cmd file (referred to by environment variable) using [io.file]::ReadAllText and iex.
Detects the Pay2Key ransomware's use of a polyglot setup.cmd script that executes embedded PowerShell code in-memory. The detection focuses on PowerShell being launched with the '-nop' flag and a specific pattern using [io.file]::ReadAllText($env:0) to read and execute the script's own content, a technique characteristic of Pay2Key's fileless execution.
Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects a malicious pattern often associated with Pay2Key where a Batch script executes PowerShell via the Sysnative folder to bypass redirection. The command uses -nop and iex to execute code directly from the script file content (using $env:0) in-memory, indicative of fileless execution techniques.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects the Lunar Client launcher or associated Java processes spawning suspicious utility processes, which may indicate exploitation of an Electron-based inter-process communication vulnerability where an attacker manipulates the gameDirectory path to achieve arbitrary code execution.
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects instances where VBScript or JScript engines (wscript.exe, cscript.exe) spawn PowerShell or BCDedit processes. The rule specifically monitors for activities related to disk tampering (e.g., physical drive access or File I/O) and the suppression of Windows recovery features via bcdedit, which are common tactics used by ransomware and destructive malware to disable system backups and prevent remediation.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects developers pasting malicious PowerShell one-liners from fake install pages.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
Page 122 of 213