Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects command-line installation of VS Code extensions (.vsix) launched by script interpreters. Threat actors like UNK_DeadDrop use this technique to silently install malicious extensions via VBScript and CMD payloads.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
Detects the execution of 'Falcon_module63.vbs', a script associated with the Iranian APT group Seedworm (also known as APT33 or Shamoon). This VBScript is often used in the initial stages of an attack for reconnaissance or to establish persistence.
Detects the specific process chain: wscript.exe -> powershell.exe -> MSBuild.exe, which is characteristic of the SHADOW#REACTOR malware campaign. This chain indicates the use of scripting interpreters (Wscript and PowerShell) to launch MSBuild for malicious purposes, often involving in-memory execution or compilation of malicious code.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
Detects the execution of 'DiscordDial.vbs' by 'wscript.exe' or 'cscript.exe'. This script is identified as a helper script used for persistence.
Detects wscript executing SyncAppvPublishingServer.vbs, which has been observed in campaigns delivering ClearFake payloads. This rule specifically looks for the execution of 'wscript.exe' with 'SyncAppvPublishingServer.vbs' in its command line.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects suspicious execution patterns involving 'wscript.exe' or 'cscript.exe' that utilize common COM objects or VBScript, while excluding executions from standard Windows and Program Files directories. It specifically looks for multiple unique command line executions within a two-hour window from the same device and account, indicating potential malicious script activity.
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Correlates execution of a .pdf.lnk shortcut spawning wscript to run the empty.vbs bridge, followed by a PowerShell process.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
Detects the creation of a scheduled task intended to execute a VBScript (.vbs). This technique is notably used by a North Korean-linked npm infostealer RAT to establish login persistence via a hidden VBS launcher.
Detects WinRAR extracting and launching HTML applications (mshta.exe) or script interpreters (wscript.exe/cscript.exe). This behavior is indicative of the CVE-2025-8088 exploit chain used by Gamaredon to deploy GammaPhish and GammaLoad.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
WScript Execution From ADS
Cortex XDR
Detects wscript.exe or cscript.exe executing a script from an Alternate Data Stream (ADS) path, specifically within the Users directory, as indicated by a colon without a preceding drive letter context. This behavior is known to be used by malware like GammaWorm for persistence by executing hidden VBScript payloads.
Detects the execution of wscript.exe loading a VBScript from a relative suspicious subdirectory like ".\data\", indicative of the initial LNK-based infection chain observed in Operation Dragon Weave.
Detects wscript.exe or cscript.exe executing a script hidden within an NTFS Alternate Data Stream (ADS). This technique is notably used by the Gamaredon group's GammaWorm to maintain fileless persistence and conceal malicious VBScript payloads (e.g., %USERPROFILE%:GTR).
Page 19 of 29