Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
This analytic detects the execution of Microsoft scripting processes (wscript.exe or cscript.exe) when they load LDAP-related modules (Wldap32.dll, adsldp.dll, adsldpc.dll). This activity is identified using Sysmon EventCode 7, which logs module loads. Such behavior can indicate an attempt to query LDAP for host information, a technique observed in implants used by threat groups like FIN7. If malicious, this could lead to attackers gathering Active Directory information for further exploitation or data exfiltration.
The analytic detects the execution of JScript using the cscript.exe process. This behavior is significant because JScript files are typically executed by wscript.exe, making cscript.exe execution unusual and potentially indicative of malicious activity, such as the FIN7 group's tactics. If confirmed malicious, this activity could allow attackers to execute arbitrary scripts, leading to code execution, data exfiltration, or further system compromise.
Detects the creation of JavaScript files within the Windows DriverStore directory. This activity has been observed in attacks by the Forest Blizzard APT (also known as Star Blizzard) to exploit CVE-2022-38028 in the Windows Print Spooler service. The adversary modified a JavaScript constraints file and executed it with SYSTEM-level permissions to achieve privilege escalation and credential access.
Detects executions of WScript.exe or CScript.exe that are running scripts with common extensions (e.g., .js, .vbs) from suspicious temporary or public user directories. This behavior is often associated with dropper scripts used in initial access or malware delivery.
Detects the execution of 'osacompile' by potentially suspicious parent processes such as 'applet' or 'osascript'. This activity can indicate an attempt to compile AppleScript or JavaScript for Automation (JXA) code, which adversaries might use for execution or obfuscation.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.
This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.
This rule detects the execution of AppleScript or JavaScript for Automation (JXA) scripts on macOS systems. It specifically looks for the 'osascript' utility being used with command-line arguments that indicate direct script execution ('-e') or the execution of script files with '.scpt' (AppleScript) or '.js' (JavaScript/JXA) extensions. This activity can be indicative of an adversary using scripting interpreters for execution.
Detects possible malicious execution of JavaScript for Automation (JXA) in-memory via the `osascript` utility on macOS. This rule specifically looks for command-line executions of `osascript` that include the `-e` flag (for executing a script string), the `eval` function, `NSData.dataWithContentsOfURL` (indicating potential remote content loading), and either explicitly specifies 'JavaScript' as the language or includes '.js' in the command line.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
This rule detects the execution of JavaScript code using 'mshta.exe'. Mshta.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious .hta files and JavaScript or VBScript, often to bypass application control solutions or browser security settings. The rule specifically looks for 'mshta.exe' as the image or original filename and the presence of 'javascript' in the command line arguments.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
Detects Wscript or Cscript executing a file with an uncommon (i.e., non-script) extension such as .csv, .dat, .doc, .gif, .jpeg, .jpg, .png, .ppt, .txt, .xls, or .xml. This technique can be used by adversaries to bypass application control or obscure malicious script execution.
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Page 33 of 34