Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.
Detects suspicious execution of scripting hosts (wscript.exe, cscript.exe, mshta.exe) that are commonly leveraged by the Gamaredon threat group. The rule specifically flags VBScript/HTA execution originating from temporary directories and monitors for the creation of persistence via Windows Registry Run keys.
This rule detects when a node.exe process, commonly used for executing npm lifecycle hooks (such as preinstall, postinstall, or various .cjs scripts), spawns suspicious child processes including shells (cmd.exe, powershell.exe, sh, bash) or scripting engines (wscript.exe, cscript.exe). This pattern is frequently observed in malicious npm packages designed to achieve code execution on a developer's machine during the package installation or build process.
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Detects LCRYX ransomware activity by monitoring wscript.exe or cscript.exe executing mass file renames with the .lcryx extension and the creation of PLEASEREADME.txt ransom notes within sensitive user directories.
Detects the execution of wscript.exe with the /elevated argument, where the process was spawned by another wscript.exe instance. This behavior is indicative of potential malicious script execution attempting to bypass normal user execution constraints or using techniques to maintain elevation, often associated with living-off-the-land binaries.
Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, which could indicate a targeted phishing attempt or malware activity.
Detects suspicious execution chains where common Windows scripting hosts (powershell.exe, cmd.exe, wscript.exe, etc.) spawn node.exe to run JavaScript files from user-writable directories (Temp, AppData, etc.). The rule flags execution patterns often associated with the TONResolver RAT, including specific PowerShell encoding or cryptography patterns and node.js scripts running from non-standard application paths.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple such executions within a one-hour window from the same device, indicating potential malicious activity like phishing or malware delivery.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
This rule detects the creation of executable or script files (e.g., .exe, .dll, .ps1, .bat, .cmd) by wscript.exe or cscript.exe within common user-writable directories such as AppData, Temp, Downloads, Documents, or Music. This activity can be indicative of malicious VBScript execution attempting to drop and execute secondary payloads, often associated with phishing campaigns.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
Detects the execution of script-based interpreters (wscript.exe, cscript.exe, powershell.exe) where the command line contains keywords typically associated with downloading or executing remote content (http, ftp, download, invoke, execute). This activity is often used in the initial stages of a malware attack to retrieve and run malicious payloads.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
This rule detects suspicious usage of Windows Script Host (wscript.exe or cscript.exe) by monitoring for the execution of VBScript files containing keyword-heavy command lines related to common phishing themes (e.g., 'Invoice', 'Payment', 'Urgent'). It flags when a specific device executes three or more such scripts within a one-hour window, which is indicative of potential bulk file processing or automated malicious activity typical of dropper or downloader malware.
Detects multiple executions of WScript.exe or CScript.exe within a single hour on the same device where the command line arguments contain document-related keywords such as Invoice, Bill, or Payment, and the file extension ends in .vbs or .vbe. This pattern often indicates mass execution of malicious scripts often delivered via email attachments or phishing lures.
Page 14 of 29