Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the silent installation of remote monitoring and management (RMM) software using 'msiexec.exe' initiated by scripting engines (powershell.exe, wscript.exe, or cscript.exe). The rule targets installations occurring in user-writable directories, such as Temp or Downloads, which are common staging locations for malicious droppers, while excluding known legitimate software deployment paths.
Detects execution or file presence associated with HOOKEDGE/HEADLACE malware. This rule uses a dual-approach: matching known malicious file hashes (SHA256) and monitoring for specific script files (bat, vbs, cmd) following a GUID-formatted naming convention typically used by the HOOKEDGE installer chain.
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
Detects execution or file presence associated with HOOKEDGE/HEADLACE malware. This rule uses a dual-approach: matching known malicious file hashes (SHA256) and monitoring for specific script files (bat, vbs, cmd) following a GUID-formatted naming convention typically used by the HOOKEDGE installer chain.
Detects execution or file presence associated with HOOKEDGE/HEADLACE malware. This rule uses a dual-approach: matching known malicious file hashes (SHA256) and monitoring for specific script files (bat, vbs, cmd) following a GUID-formatted naming convention typically used by the HOOKEDGE installer chain.
This rule detects the execution of potentially malicious files (executables, scripts) from user-writable directories (Downloads, AppData, Desktop) where the file appears to be related to a ZIP archive recently downloaded or extracted by an archive handler or browser. It correlates process execution events with file creation events from ZIP archives to identify potential user-execution of malicious payloads delivered via ZIP files.
This rule detects the execution of potentially malicious files (executables, scripts) from user-writable directories (Downloads, AppData, Desktop) where the file appears to be related to a ZIP archive recently downloaded or extracted by an archive handler or browser. It correlates process execution events with file creation events from ZIP archives to identify potential user-execution of malicious payloads delivered via ZIP files.
Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine
Pulls the full content of every PowerShell, VBS, and JS script executed on a given host. Use * in both parameters to get everything
Detects a suspicious execution chain where wscript.exe is used to run a file named 'rust-setup-launch.vbs' from a temporary directory, which subsequently triggers powershell.exe to execute a script named 'rust-setup.ps1'. This behavior is indicative of a staged supply chain attack.
Correlation detection for the PureLogs Stealer / fake Adobe Sign campaign. Fires when 3+ of 6 distinct attacker behaviors (Downloads-sourced 'output_*.js' execution via wscript/cscript, UserinitMprLogonScript persistence pointing at a .js payload, PowerShell fileless env-var payload reconstruction via [System.Environment]::GetEnvironmentVariable+IEX, in-memory .NET Assembly.Load without a disk-based .dll/.exe argument, PowerShell-initiated PixelDrain PNG retrieval, and PowerShell-initiated C2 traffic to vm180012.hosted-by.qwins.co) occur on the same host within a 15-minute window. All network/PowerShell legs are scoped to powershell.exe specifically to avoid flagging benign browser traffic to the legitimate PixelDrain file-sharing service.
Detects wscript.exe executing the VBScript launcher OptiDrive.vbs from the ACRStealer masquerade staging path (%LOCALAPPDATA%\DriveOptimize Technologies\), used to invoke the persistent compiled AutoIt payload.
Detects wscript.exe executing OptiDrive.vbs from the %LOCALAPPDATA%\DriveOptimize Technologies\ masquerade directory to invoke the renamed AutoIt interpreter OptiDrive.exe — the ACRStealer staging/masquerade technique.
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
KQL Query
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Page 6 of 29