Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
11
2
1
Contributors
7
4
3
Categories
7
6
5
2
1
Platforms
13
1
Products / Services
4
3
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.
Detects PubPrn.vbs used for COM scriptlet proxy execution
Detects system scripts like PubPrn used as execution proxies for defense evasion
This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands.
Detects the use of the 'Launch-VsDevShell.ps1' Microsoft signed script to execute commands.
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Detects the execution of the Microsoft-signed PowerShell script 'Launch-VsDevShell.ps1' with specific command-line arguments ('VsWherePath ' or 'VsInstallationPath '). This script can be abused to proxy the execution of other commands, potentially for defense evasion.
Detects the use of the 'Pubprn.vbs' Microsoft signed script to execute commands, specifically looking for the 'script:' argument which can be abused for proxy execution of remote files. This technique is often used for defense evasion.
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.