Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
79 detections
Filters
Last updated
All Time
Detection languages
60
8
7
2
1
Contributors
29
29
6
4
4
Categories
62
24
17
9
4
Platforms
77
2
1
1
Products / Services
22
21
8
5
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the execution of Syncappvpublishingserver.vbs via wscript.exe or cscript.exe, which may indicate an attempt to download remote files or perform privilege escalation. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. Monitoring this activity is crucial as it can signify malicious use of a native Windows script for unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized file downloads or elevated privileges, posing a significant security risk.
Detects the use of the WinGet 'configure' command to process PowerShell DSC configuration files. This method can be abused to execute arbitrary PowerShell code within a Script resource without explicitly invoking powershell.exe, potentially bypassing certain monitoring or security controls focused solely on the PowerShell executable.
Detects the abuse of the legitimate Windows script 'SyncAppvPublishingServer.vbs' to proxy the execution of malicious commands, specifically by appending an arbitrary command separated by a semicolon.
Detects the Windows Help executable (hh.exe) launching the Windows script interpreters (wscript.exe or cscript.exe) with suspicious command-line flags. This pattern is commonly used in fileless malware delivery, script-based obfuscation, and bypass of security controls using built-in Windows utilities.
This rule detects the execution of PowerShell via wscript.exe or certutil.exe, followed by the use of suspicious command-line arguments often associated with malicious fileless execution, such as downloading content from the web or executing base64 encoded payloads.
Detects PubPrn.vbs used for COM scriptlet proxy execution
Detects system scripts like PubPrn used as execution proxies for defense evasion
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
Detects calls to "LoadAssemblyFromPath" or "LoadAssemblyFromNS" that are part of the "CL_LoadAssembly.ps1" script. This can be abused to load different assemblies and bypass App locker controls.
Detects an attempt to execute code or create service on remote host via winrm.vbs.
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"
Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)
Detects execution of attacker-controlled WsmPty.xsl or WsmTxt.xsl via winrm.vbs and copied cscript.exe (can be renamed)
Detects the execution of CustomShellHost.exe where the child isn't located in 'C:\Windows\explorer.exe'. CustomShellHost is a known LOLBin that can be abused by attackers for defense evasion techniques.
Detects potential abuse of the "manage-bde.wsf" script as a LOLBIN to proxy execution
Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)
Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.
Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands
Detects uncommon child processes spawning from "sigverif.exe", which could indicate potential abuse of the latter as a living of the land binary in order to proxy execution.
Detects the execution of scriptlet files or the use of scrobj.dll (squiblydoo)via command line, particularly when initiated by common scripting or command interpreters like cmd.exe, powershell.exe, wscript.exe, or cscript.exe.
Page 1 of 4