Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects the execution of the built-in Windows script "gatherNetworkInfo.vbs" which is commonly used to collect network configuration details and other system information. This activity can be indicative of reconnaissance by an adversary.
Detects the execution of the built-in Windows script 'gatherNetworkInfo.vbs' via cscript.exe or wscript.exe. This script is designed to gather detailed network information about the target machine, which can be leveraged by adversaries for reconnaissance purposes.
Detects Wscript or Cscript executing a file with an uncommon (i.e., non-script) extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. This technique can be used by adversaries to bypass application control or obscure malicious script execution.
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
This YARA rule detects the Badbeeteam ransomware by identifying specific byte patterns associated with its file finding, file encryption, and HTA file dropping functionalities. The rule looks for distinct sequences of bytes in the executable to identify the presence of this particular ransomware.
Page 29 of 29