Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects the use of common scripting engines (PowerShell, WScript, CScript, MSHTA) to perform system fingerprinting, sandbox detection, or execution timing delays. This activity is often indicative of early-stage malware or reconnaissance tools attempting to identify if they are running in a virtual or analysis environment before proceeding with malicious activity.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
Detects the creation of files with names containing 'winPatch' and extensions of '.zip' or '.vbs' in Windows TEMP directories, originating from PowerShell or WScript processes. This behavior is indicative of potential ingress tool transfer or staging of malicious scripts.
Detects the execution of VBScript files (via wscript.exe or cscript.exe) where the parent process is a common web browser (Chrome, Firefox, Edge, or IE). This pattern is frequently indicative of a drive-by download or social engineering attack where a user is tricked into executing a malicious script originating from a web-based context.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
This rule detects the execution of VBScript files using wscript.exe or cscript.exe that are closely followed by network connections to known public IP geolocation services (ip-api.com, ipinfo.io, api.country.is). It further enhances the detection by checking if a secondary process is spawned from the same host, which may indicate a payload retrieval or execution phase typical of malware staging.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects persistence mechanisms used by Gamaredon's Ptero-family implants (e.g., PteroSetup, PteroPSDoor) which modify Windows registry run keys to execute malicious scripts or binaries located in suspicious directories like APPDATA or TEMP. The detection specifically looks for the combination of registry run key modifications and the use of obfuscated or stealthy execution arguments associated with PowerShell, VBScript, or MSHTA.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload. This rule correlates two distinct process events: a wscript.exe initiated cmd.exe process executing 'tar -xf dll.zip', followed by a 'chost.exe' process executing 'loader.py' on the same device and account within a 5-minute window.
Detects references to the ChainShell installer script 'VfZUSQi6oerKau.js' within process command lines. This script is associated with the MuddyWater threat group.
Detects suspicious process injection attempts where common scripting/execution binaries (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are observed creating remote threads in other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe). The detection is further refined by looking for specific keywords in the initiating process's command line that are indicative of malicious activity, such as downloading content or executing scripts. This rule aims to identify advanced persistent threats and malware leveraging process injection for defense evasion and privilege escalation.
Detects LCRYX ransomware components executing via wscript.exe or cscript.exe to download secondary malicious payloads using MSXML2.ServerXMLHTTP and ADODB.Stream, targeting the C:\Windows\ directory. The rule matches on specific C2 domains/IP addresses and known file drop paths associated with multi-stage malware infections.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
Page 12 of 29