Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the execution of mshta.exe or wscript.exe with a command line pattern matching the PeckBirdy C2 framework's API for fetching landing scripts. The pattern consists of a 32-character ID followed by '/hta', '/wscript', or '/html'.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a suspicious child process (like cmd.exe or powershell.exe) from a document located in a configured Office Trusted Location. While trusted locations are meant to bypass macro security warnings, the subsequent spawning of shell processes is a strong indicator of malicious macro execution for post-exploitation activities.
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects the execution of a VBScript file named 'windows_api.vbs' from common public or appdata directories, a characteristic behavior of the GOGITTER malware as part of the Gopher Strike campaign.
Detects the use of a command injection vulnerability in the legitimate Windows script 'SyncAppvPublishingServer.vbs' to execute arbitrary code. As seen in the ClearFake campaign, attackers can append a semicolon to the command-line arguments to execute subsequent malicious PowerShell commands.
Detects the execution of the RustyWater implant payload "CertificationKit.ini" from the "C:\ProgramData" directory. This activity is associated with the MuddyWater APT group.
Detects the SHADOW#REACTOR process execution chain of wscript.exe spawning powershell.exe, which in turn spawns MSBuild.exe.
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects a suspicious process chain involving wscript.exe spawning powershell.exe, which then spawns MSBuild.exe. This specific chain is characteristic of the SHADOW#REACTOR malware campaign, indicating potential execution of malicious code via trusted utilities.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Detects the execution of PowerShell or VBScript commands that contain indicators of base64 encoding. This is a common obfuscation technique used by malware like DarkGate to hide malicious payloads, often seen in social engineering campaigns like "ClickFix".
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detects Windows Script Host (wscript.exe or cscript.exe) execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors frequently use raw or hex IP literals to bypass domain-based filtering and deliver payloads via script-based loaders.
Detects the creation of VBScript or Batch files in the Windows Startup folder. This is a common persistence technique used by various malware families, including the scripts (`pws1.vbs`, `PWS.vbs`, `startuppp.bat`) dropped by the SERPENTINE#CLOUD campaign.
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
Detects command line parameters used by Koadic hack tool
Detects the execution of a script file (e.g., VBS, JS, BAT, PS1) from a removable drive using a common script interpreter. This technique is used by the threat actor Tangerine Turkey for initial access.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
These rules detect encrypted ZIP files that contain only a single entry. The rules further specialize to detect if that single entry is a VBScript (.vbs) or Microsoft Management Console (.msc) file. This pattern is often used by adversaries to deliver malicious payloads, bypassing email security solutions that might not scan encrypted archives or might not recognize the malicious intent of single-entry archives containing specific script or configuration file types.
Detects the execution of PowerShell, VBScript, PHP, JavaScript, or WSF scripts from the 'AppData\Local\Temp' directory by common Windows processes like explorer.exe or svchost.exe. This behavior can indicate malicious activity where scripts are dropped into temporary locations and then executed.
Page 23 of 29