Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects the hh.exe (HTML Help) process spawning wscript.exe. This behavior is a common indicator of a Compiled HTML (CHM) file executing an embedded malicious VBScript payload, often used for initial access or malware delivery.
Detects wscript.exe or cscript.exe executing VBScript to query WMI classes (Win32_OperatingSystem, Win32_ComputerSystem, Win32_Processor) or 'Basic System' information. This activity is often used for host reconnaissance and fingerprinting by threat actors prior to C2 check-in, notably observed in Kimsuky multi-stage tradecraft.
Detects the execution of wscript.exe with the //b and //e:vbscript flags, forcing the Windows Script Host to interpret a file as VBScript regardless of its file extension. This technique is used to bypass extension-based security controls, with documented use by the Kimsuky threat group.
Detects wscript or cscript executing shell commands (del/delete) to remove .jse files. This pattern is commonly associated with malicious scripts attempting to clean up traces of their execution after running from temporary locations.
Detects the execution of WScript.exe invoking discovery-related WMI objects or common system enumeration commands such as 'tasklist'. This activity is often associated with initial reconnaissance, environmental discovery, or script-based malware post-compromise.
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Detects the spawning of Windows Script Host (wscript.exe or cscript.exe) as a child process of common web browsers (chrome.exe, msedge.exe, firefox.exe). This pattern is often indicative of a drive-by download attack or a user executing a malicious script file downloaded from the internet.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
Detects the use of WScript.exe to execute non-script extensions (e.g., .ini, .dat, .txt) as VBScript. Adversaries often use this technique to bypass file extension restrictions or execute obfuscated payloads by forcing a non-executable file type to be parsed by the Windows Scripting Host.
Detects the execution of wscript.exe or cscript.exe which are commonly used to execute VBScript files for performing host reconnaissance tasks such as process enumeration via WMI and file system discovery using Scripting.FileSystemObject.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.
Detects the use of certutil.exe to decode a base64-encoded file named Link.dat into an executable VBScript payload named Link.ini, specifically within the %USERPROFILE%\Links directory. This behavior is indicative of Kimsuky infection chains where malicious CHM files or MSHTA scripts trigger secondary payloads.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Detects multiple executions of wscript.exe or cscript.exe within an hour that involve command-line arguments containing business-related keywords (e.g., Invoice, Payment) and script extensions (.vbs or .vbe). This behavior is often indicative of automated malware staging, such as malicious macro-enabled documents spawning script engines.
Detects suspicious child processes (such as PowerShell, CMD, or WScript) being spawned by Microsoft Office applications or email clients, which is indicative of exploitation activity consistent with Gamaredon spear-phishing campaigns. This specifically monitors for execution patterns attempting to deploy 'Ptero' family implants potentially following exploitation of vulnerabilities such as CVE-2025-8088.
Detects the deletion or renaming of .jse (JScript Encoded) files by the Windows script hosts wscript.exe or cscript.exe. This activity is often associated with the cleanup of obfuscated scripts after they have been executed as part of a malicious campaign.
Page 8 of 29