Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Detects VSLauncher.exe execution or image loading involving input.dll under SysWOW64, indicative of DLL side-loading by the UAC-0184 threat actor.
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Detects the execution of mshta.exe with command-line arguments indicating it is loading a script (VBScript, JavaScript) or a URL. This behavior is commonly abused by adversaries for code execution and bypassing application controls.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns suspicious child processes. The suspicious child processes include certutil.exe, mshta.exe, rundll32.exe, curl.exe, wget.exe, wscript.exe, cscript.exe, bitsadmin.exe, regsvr32.exe, msiexec.exe, and cmd.exe. The rule also includes a join to ensure the parent PowerShell process was launched by explorer.exe, which can help filter out some automated or administrative PowerShell activities.
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
Detects installation of a remote msi file from web.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Detects when a user installs certificates by using CertOC.exe to load the target DLL file.
Detects execution of Cmdl32 with the "/vpn" and "/lan" flags.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs
Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system
Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.
Detects file execution using the msdeploy.exe lolbin
Page 13 of 45