Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Adversaries may abuse Visual Basic (VB) for execution
Detects potential QBot activity by looking for process executions used previously by QBot
Detects remote thread creation from CACTUSTORCH as described in references.
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
'This rule identifies a web request to a URL that holds a file type, including .ps1, .bat, .vbs, and .scr that can be harmful if downloaded. This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
Adwind RAT / JRAT
Sigma
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
The following analytic detects a suspicious process making DNS queries to known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms. It leverages Sysmon EventID 22 logs to identify queries from processes like cmd.exe, powershell.exe, and others. This activity is significant as it may indicate an attempt to download malicious files, a common initial access technique. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the target host.
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects wscript/cscript executions of scripts located in user directories
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects command line parameters used by Koadic hack tool
Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers
Detects potential process and execution activity related to APT10 Cloud Hopper operation
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Page 26 of 29