Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects wscript.exe (or cscript.exe) executing a JavaScript file from the C:\Users\Public\ directory. This behavior is indicative of the relocated JScript loader stage observed in a recent malspam .NET loader campaign.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
Detects the execution of wscript.exe loading a script file from the C:\Users\Public\ directory, a behavior observed in the DesckVB RAT staging process. This technique is often used by adversaries to execute malicious scripts from a commonly accessible location.
Detects the execution of arbitrary VBScript code dropped into the user's temporary directory by the GammaSteel C2 fallback mechanism. The payload is typically written to a temporary file and executed using wscript.exe with specific flags (//e:vbscript and //b).
Detects VS Code or Cursor launching wscript.exe with specific command-line arguments indicating hidden execution of VBScript payloads. This behavior is associated with the UNK_DeadDrop campaign.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.
Identifies wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags, indicative of potential MonoGlyphRAT staging activity.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects the immediate persistence mechanisms (VBScript and Startup shortcut) established by KongTuke's ModeloRAT within minutes of initial execution. This rule specifically looks for PowerShell execution that contains commands to create both a VBScript file named 'scriptA.vbs' and a Startup shortcut named 'StartManagerB.lnk', which are highly specific indicators of this threat.
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects when a Microsoft Office application (Word, Excel, PowerPoint) spawns a command interpreter (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute commands on the system.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Page 20 of 29