Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.
Detects LCRYX ransomware activity orchestrated by VBScript using wscript.exe or cscript.exe. The rule monitors for the mass encryption of files identified by the .lcryx extension and the creation of PLEASEREADME.txt ransom notes, typical behaviors of this ransomware variant.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects the execution of wscript.exe or cscript.exe with the /elevated command-line argument, which is a known technique for bypassing User Account Control (UAC) or invoking administrative tasks via COM object elevation.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
Detects web browsers and browser-related applications (e.g., Chrome, Edge, ChatGPT, Electron apps) spawning suspicious child processes that are commonly used for command-line execution or script interpretation. This behavior is often indicative of malicious extensions, browser exploits, or attempts to leverage browser processes for initial execution or lateral movement.
Detects the execution of script files (e.g., .js, .jse, .vbs) via Windows Script Host (wscript.exe, cscript.exe) where the parent or grandparent process is a known archive extraction utility (e.g., 7zip, WinRAR). The rule further filters by identifying keywords associated with malicious lures (e.g., 'health', 'medical', 'nhis'). This behavior is commonly associated with phishing campaigns delivering malicious attachments.
Detects instances where script interpreters (wscript/cscript on Windows; sh/bash/busybox on Linux) are used to spawn command-line tools (cmd.exe or rm/unlink) to perform file deletion operations. This is a common pattern for attackers to remove evidence, logs, or tools post-execution.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Access, Publisher) spawning common command interpreters or scripting engines. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used as an initial access vector to execute arbitrary code.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Access, Publisher) spawning common command interpreters or scripting engines. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used as an initial access vector to execute arbitrary code.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects LCRYX ransomware performing UAC bypass by utilizing VBScript to spawn a new wscript.exe process with elevated privileges. The rule monitors for WScript or CScript processes spawning another WScript process where the command line contains the '/elevated' flag, indicating the use of the Shell.Application object's ShellExecute method with the 'runas' verb.
Detects instances where wscript.exe spawns a child process of itself with the /elevated command-line flag, a behavior often indicative of attempts to bypass User Account Control (UAC) or gain elevated script execution privileges.
Detects attempts by scripts (spawned via wscript.exe, cscript.exe, or powershell.exe) to disable or interfere with security products. This includes disabling Microsoft Defender via registry modifications or PowerShell commands, disabling the Windows Firewall using netsh, and terminating or stopping security software processes and services using taskkill, sc, or net.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects VBScript-driven reconnaissance using wscript.exe that executes WMI queries to enumerate running processes via Win32_Process or identifies installed antivirus products via the SecurityCenter2 namespace. This behavior is often associated with early-stage malware reconnaissance activities.
Detects the execution of wscript.exe using VBScript features such as 'FileSystemObject' and 'Shell.Application' to perform directory enumeration. This pattern is commonly observed in malicious scripts used by threat actors, such as Kimsuky, to discover files and system information during the reconnaissance phase of an attack.
Page 11 of 29