Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects the installation of specific malicious versions of several npm packages. Threat actors gained access to maintainer accounts via a phishing campaign and published compromised versions containing malware. The payloads ranged from a Windows-based information stealer (Scavenger) to a cross-platform JavaScript backdoor.
Detects the execution of suspicious commands commonly used for reconnaissance or networking, where the parent process command indicates it was triggered by an npm 'postinstall' script. This behavior is associated with the XORIndex loader used in the "Contagious Interview" campaign.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Detects execution of files from Downloads, Temp, or AppData folders by browsers, indicating potential FileFix attacks where malicious files are downloaded and immediately executed.
Detects suspicious commands written to the RunMRU registry key. This is a characteristic of the "ClickFix" social engineering technique, where a user is tricked into copying a malicious command and executing it via the Windows Run dialog (Win+R). This technique is notably used by Lumma Stealer affiliates.
Detects Windows Script Host execution of suspicious file types from browsers, often used in FileFix attacks to execute malicious VBScript or JScript files.
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
This rule detects the execution of common Windows utilities (PowerShell, Regsvr32, BITSAdmin, Certutil, MSHTA) when initiated by a web browser. This behavior can indicate an attempt to execute malicious code or download additional payloads after a user clicks a malicious link or visits a compromised website. Adversaries often leverage these utilities for various purposes, including code execution, file transfer, and bypassing security controls.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Detects the execution of mshta.exe to fetch and run remote scripts, a technique used by TAG-140 for initial access and loading the BroaderAspect loader and DRAT V2. This activity is often initiated via social engineering lures.
Detects suspicious execution of JavaScript via WScript or CScript, often indicative of initial access malware delivery by Skeleton Spider (FIN6) using .LNK files. This aligns with the "More_eggs Malware Delivery Chain" where .LNK files execute hidden JavaScript using wscript.exe.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Adwind RAT / JRAT
Sigma
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects wscript/cscript executions of scripts located in user directories
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Page 30 of 34