Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
This rule detects modifications to Internet Explorer registry settings, which attackers can abuse for persistence or defense evasion. Specifically, it looks for changes within the 'Software\Microsoft\Windows\CurrentVersion\Internet Settings' registry path. Potential malicious activities include adding domains to the Trusted Sites Zone or injecting JavaScript for persistence. The rule filters out common benign modifications related to DWORD values, Office applications, cache, ZoneMap, WpadDecision paths, binary data, and changes made by 'RuntimeBroker.exe' or within 'Accepted Documents' to reduce false positives.
This rule detects potential SVG-based phishing attempts originating from Microsoft Outlook. It correlates network access, file downloads, and URL click telemetry to identify instances where Outlook initiates connections to or downloads files ending with '.svg'. This is particularly relevant for detecting phishing campaigns that leverage malicious SVG files to embed JavaScript, redirectors, or Base64-encoded HTML payloads for credential harvesting or other malicious activities.
RedCanary recommends to create a Policy wich opens js files in Notepad (https://redcanary.com/blog/threat-intelligence/notepad-javascript/) to prevent the execution of malicious payloads.
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
This Query detects instances where 'wscript.exe' or 'cscript.exe' are initiated by 'openwith.exe' or 'explorer.exe' and execute a JavaScript file (.js) located within a user's profile directory. This behavior can indicate an attempt to execute malicious scripts, often delivered via user interaction (e.g., opening a malicious file).
The analytic detects the execution of "mshta.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". This activity is significant because mshta.exe can be exploited to execute malicious scripts, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or establish persistence within the environment, posing a severe security risk.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
Detects the execution of NeutralinoJS framework components ('neutralino.exe', 'node.exe') from non-standard directories. This behavior is associated with the EvilAI campaign, where threat actors leverage the NeutralinoJS framework to execute arbitrary JavaScript code for covert data access and process spawning. The detection specifically looks for the '--load-dir-res' argument, which is a strong indicator of a NeutralinoJS application launch, and filters out executions from standard application installation directories to focus on anomalous locations, which can indicate malware masquerading as a portable app or running from a temporary/user location.
Detects a suspicious sequence where a JavaScript file is executed, followed shortly by the execution of a Windows Installer (MSI) package on the same host. This pattern is consistent with the initial access technique used by threat actors like Lunar Spider, where a malicious script downloads and runs a subsequent payload.
This query groups all files by their originating file—such as a ZIP archive or from a Website—and includes all the files that were extracted from it. Among the benefits of Correlating File Events Using InitiatingProcessUniqueId field we can identify:
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
- Provides full visibility into all files related to a single action (e.g., ZIP extraction).
- Helps detect hidden or secondary malicious files that may not trigger alerts.
- Traces the origin of files—whether downloaded or extracted from another source.
- Strengthens root cause analysis and incident investigation.
- Enhances detection of multi-stage payloads or complex delivery methods.
- Builds context around suspicious activity for better decision-making.
On the other hand, we can enhance this detection by adding additional checks — for example, identifying when one of the extracted or downloaded files has a high-risk file extension.
| where FileExtension in ("exe","cmd","bat","ps1","js","vbs")
Detects the execution of JavaScript or JSC files using the Node.js binary (node.exe). This activity can be suspicious as adversaries have been observed abusing Node.js to disguise malware, evade security defenses, and maintain persistence. While Node.js is commonly used, unusual occurrences of this activity in an environment warrant immediate investigation.
Detects potentially suspicious inline JavaScript execution using the Node.js binary. The rule specifically looks for the execution of 'node.exe' combined with command-line arguments that contain keywords indicative of malicious activity, such as 'http' (for network communication), 'execSync' or 'spawn' (for executing system commands), 'fs' (for file system operations), 'path', and 'zlib' (often used in unpacking or data manipulation). This combination suggests an attempt to execute arbitrary code or perform system interactions via Node.js.
Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development.
Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems.
Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.
Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.
Detects the execution of a malicious Node.js payload, a technique used by the EvilAI malware campaign. EvilAI launches node.exe via cmd.exe to run a JavaScript file from the user's temporary directory. The script name follows a specific pattern (GUID followed by 'or', 'ro', or 'of').
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
Detects common JavaScript patterns used for reflective code loading and dynamic code execution. Adversaries use these techniques to obfuscate malicious code and evade static analysis by executing code from strings or other dynamic sources.
Detects a malicious JavaScript file used in the DarkCloud campaign. This script uses WScript.Shell to execute an obfuscated PowerShell command, which downloads and executes a second-stage .NET payload.
RAR SFX-based dropper that extracts a JS payload (DarkWatchman-style)
The following analytic identifies child processes spawned by vmtoolsd.exe, the VMWare Tools service in Windows, which typically runs with SYSTEM privileges. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. Monitoring this activity is crucial as it can indicate exploitation attempts, such as CVE-2023-20867. If confirmed malicious, attackers could gain SYSTEM-level access, allowing them to execute arbitrary code, escalate privileges, and potentially compromise the entire system.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
Page 29 of 34