Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects the execution of script interpreters (mshta, wscript, cscript) or PowerShell initiated by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This pattern is a common indicator of malicious macro or embedded script execution, often used to deliver secondary payloads.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the Gamaredon PteroVDoor malware chain, including initial execution of obfuscated VBScript files from Office applications or temporary folders, the spawning of PowerShell with obfuscated arguments, subsequent C2 communication over common ports to dynamic DNS domains, and secondary WMI event subscription persistence.
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating a phishing attempt or malware execution.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects frequent execution of VBScript files using wscript.exe or cscript.exe where the command-line arguments contain suspicious keywords often associated with phishing lures or malicious documents. The rule triggers when a single device executes three or more such processes within a one-hour window.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects a multi-stage in-memory delivery chain associated with Operation Poisson, where wscript.exe spawns powershell.exe to load and execute the Havoc Demon agent in memory via a VBScript stager.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Detects the execution of VBScript, JavaScript, or HTA files via cscript.exe or wscript.exe when the script file originates from suspicious locations such as AppData, Temp, or via URL/network paths. The rule filters out scripts launched by known trusted publishers to minimize noise from legitimate system or application activity.
Detects the execution of VBScript, JavaScript, or HTA files via cscript.exe or wscript.exe when the script file originates from suspicious locations such as AppData, Temp, or via URL/network paths. The rule filters out scripts launched by known trusted publishers to minimize noise from legitimate system or application activity.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript, PowerShell) to launch the Microsoft Build Engine (MSBuild) for potentially malicious code execution.
This rule detects the execution of a VBScript file named 'ResetRealtekAudioSettings64.vbs' by 'wscript.exe'. This specific activity has been associated with AsyncRAT, where it's used to continue the execution chain, potentially to spoof audio settings or for other malicious purposes.
Page 13 of 29