Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detects the creation of an unusually large 'bun_environment.js' file (>= 9MB). This is a characteristic of the Shai-Hulud 2.0 worm which uses extreme obfuscation, resulting in a massive payload file.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects the execution of an executable file from the AppData\Local directory by the Windows Script Host (wscript.exe or cscript.exe). This behavior is unusual and was observed in the CHAMELEON#NET campaign where JavaScript droppers were used to launch subsequent stages.
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
Detects the execution of a JavaScript file via wscript.exe or cscript.exe where the file path in the command line contains a tilde (~). This is indicative of the Gootloader malware, which leverages Windows 8.3 short filenames (e.g., "ADAPTI~1.JS" for "Adaptive Algorithms.js") as part of its persistence mechanism to evade simple string-based detections. The persistence scripts are typically dropped in subfolders under the user's AppData\Roaming directory.
Detects Gootloader's persistence mechanism where a shortcut (.lnk) file is placed in the Startup folder or AppData, which in turn executes a JavaScript file using an 8.3 short filename.
Detects execution of Node.js from unusual locations or associated with network connections to known C2 infrastructure, as seen in campaigns distributing backdoors disguised as legitimate software.
This rule detects suspicious WebAssembly (WASM) code in HTTP responses that indicates the allocation of Read-Write-Execute (RWX) memory pages. This pattern is a common precursor to shellcode execution within a web browser, often used by exploit kits or malicious websites to achieve arbitrary code execution. The rule specifically looks for JavaScript code that initializes a WebAssembly module with a byte array containing specific patterns indicative of RWX memory allocation, followed by instantiation and export calls.
SesameOP Uses OpenAI Assistants API as a mechanism for command-and-control (C2) communications. Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised environment. To do this, a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.
Detects possible malicious execution of JXA in-memory via OSAScript
Detects command line parameters used by Koadic hack tool
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
Detects the execution of PowerShell, VBScript, PHP, JavaScript, or WSF scripts from the 'AppData\Local\Temp' directory by common Windows processes like explorer.exe or svchost.exe. This behavior can indicate malicious activity where scripts are dropped into temporary locations and then executed.
Detects Windows Script Host (wscript.exe) or masquerading binaries executing JavaScript (.js) files from user-writable paths such as C:\Users\ or C:\ProgramData\. This behavior is commonly associated with phishing payloads, malware droppers, or persistence mechanisms that execute user-space scripts. The rule covers both legitimate wscript.exe and renamed or spoofed variants.
Page 28 of 34