Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects a VBS script invoking PowerShell to decode a Base64 payload, write it to disk with a random name, and decompress it using IO.Compression.GzipStream into tmp*.bat.gz/tmp*.bat files, consistent with the AutoIT-based VIPKeylogger/MedusaHVNC infection chain.
Detects the AutoIT payload injector multi-stage execution chain (wscript.exe -> powershell.exe -> cmd.exe -> powershell.exe -> autoit3.exe -> charmap.exe) used to deliver VIPKeylogger and MedusaHVNC, culminating in process injection into the legitimate charmap.exe utility.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects a specific attack chain where users are tricked into copying and pasting a malicious command (ClickFix) that downloads and executes a secondary stager named winPatch.zip via curl or wscript.exe, commonly associated with recent social engineering campaigns.
Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility, where the parent process is a Windows script host ('wscript.exe' or 'cscript.exe'). This is a common technique used by malware for persistence.
This rule detects execution chains associated with the Quima RAT loader, specifically monitoring for VBScript-based child processes spawning suspicious command-line activity. This includes the use of certutil.exe to decode payloads, discovery commands like 'where javaw', and the execution of suspicious Java processes with specific arguments or paths indicative of malicious behavior.
Detects Blind Eagle JC-46 VBScript/JScript loader obfuscation toolmarks: zv-prefixed self-mutating XOR decryptor with 0xE0 key, junk arithmetic index shuffle, custom RC4-like stream decoder, custom AES S-box/RCON with 0xA5 mask, Wales() decimal decoder, Base28 alphabet, and oversized VBScript droppers
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects remote thread creation from CACTUSTORCH as described in references.
This rule detects potential malicious activity where PowerShell is used to write base64-encoded files disguised with non-script extensions (e.g., .ini), which are subsequently decoded using 'certutil.exe -decode' and executed via 'wscript.exe'. This chain is a common technique used to bypass security controls by obfuscating script content and utilizing legitimate system binaries for deobfuscation and execution.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Detects a persistent loading pattern attributed to the Kimsuky threat group. The rule monitors for the creation of a hidden scheduled task named 'Edge Updater' that triggers a wscript.exe process executing a disguised VBScript file named with an 'OfficeUpdater' naming convention. This detection covers both the task registration (Event ID 4698) and the subsequent execution of the malicious script via wscript.exe.
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.
Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.
Detects execution of OfficeUpdater VBScript via wscript.exe or cscript.exe with specific command line arguments, or the creation of corresponding .ini configuration files. This pattern is indicative of potential malicious activity or persistence mechanisms mimicking legitimate update processes.
Page 7 of 29