Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
This rule detects the execution of scheduled tasks that launch specific, potentially suspicious, Living Off The Land Binaries (LOLBINs) or other uncommon programs. The detection focuses on programs like calc.exe, cscript.exe, mshta.exe, mspaint.exe, notepad.exe, regsvr32.exe, and wscript.exe when they are initiated by the Task Scheduler. The intent is to identify potentially malicious activity where adversaries might use scheduled tasks for persistence, execution, or privilege escalation by leveraging legitimate system utilities in an unusual context.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
Detects when an attacker attempts to modify an existing scheduled task to execute a payload from suspicious locations. This technique allows attackers to bypass detection mechanisms that primarily focus on the creation of new scheduled tasks, by instead altering a legitimate task to include their malicious code.
Detects scheduled task creation using the 'schtasks' utility that incorporates suspicious or uncommon command-line patterns. This includes tasks scheduled to run frequently (e.g., every minute) or as the 'system' user, combined with common command interpreters ('cmd'), or containing keywords often associated with malicious activity like PowerShell download commands, obfuscation techniques, or execution from temporary/public user directories. It also flags the use of scripting engines (cscript, wscript) or curl within scheduled tasks.
This rule detects the creation of suspicious child processes by 'KeyScrambler.exe'. KeyScrambler is legitimate software designed to encrypt keystrokes, but if compromised, it could be used to launch malicious binaries. The rule specifically looks for 'KeyScrambler.exe' as a parent process launching common Windows utilities often abused by attackers, such as 'cmd.exe', 'cscript.exe', 'mshta.exe', 'powershell.exe', 'pwsh.exe', 'regsvr32.exe', 'rundll32.exe', and 'wscript.exe'. This behavior could indicate an attacker leveraging a compromised KeyScrambler process for execution, defense evasion, or privilege escalation.
Detects mshta.exe or masquerading binaries executing HTA files (.hta) from user-writable paths such as C:\Users\.
Threat actors leverage mshta for proxy execution or to launch malicious HTA payloads stored under user profiles.
Threat actors leverage mshta for proxy execution or to launch malicious HTA payloads stored under user profiles.
This detection identifies potential abuse of SSH ProxyCommand by monitoring for suspicious process execution patterns. Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line. This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) spawning suspicious child processes. This activity is uncommon for baaupdate.exe and could indicate an attempt at lateral movement or defense evasion, potentially via BitLocker DCOM & COM Hijacking, by using baaupdate.exe as a proxy for executing other system utilities.
The analytic detects the execution of "mshta.exe" with inline protocol handlers such as "JavaScript", "VBScript", and "About". This activity is significant because mshta.exe can be exploited to execute malicious scripts, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or establish persistence within the environment, posing a severe security risk.
The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
The analytic detects the use of Microsoft HTML Application Host (mshta.exe) to make remote HTTP or HTTPS connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments containing URLs. This activity is significant because adversaries often use mshta.exe to download and execute remote .hta files, bypassing security controls. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network infiltration.
The analytic detects a suspicious `mshta.exe` process spawning `rundll32.exe` or `regsvr32.exe` child processes. This activity is a known technique used by malware like Trickbot to load malicious DLLs and execute payloads. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or download additional malware, posing a severe threat to the environment.
The following analytic identifies instances where mshta.exe has been renamed and executed. It leverages Endpoint Detection and Response (EDR) data, specifically focusing on the original file name field to detect discrepancies. This activity is significant because renaming mshta.exe is a common tactic used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
The analytic detects Microsoft OneNote spawning `mshta.exe`, a behavior often associated with spearphishing attacks. This activity is significant as it is commonly used by malware families like TA551, AsyncRat, Redline, and DCRAT to execute malicious scripts. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to data exfiltration, system compromise, or further malware deployment. Immediate investigation and containment are recommended.
The following analytic detects the spawning of mshta.exe by wmiprvse.exe or svchost.exe. This behavior is identified using Endpoint Detection and Response (EDR) data, focusing on process creation events where the parent process is either wmiprvse.exe or svchost.exe. This activity is significant as it may indicate the use of a DCOM object to execute malicious scripts via mshta.exe, a common tactic in sophisticated attacks. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise and further malicious activities.
This KQL detection will create an incident related to malicious .html execution on device
Detects the creation of suspicious child processes, such as common scripting or living-off-the-land binaries (LOLBINs), originating from applications located within the WindowsApps directory. This activity could indicate the execution of malicious '.appx' packages or other forms of code execution from an unexpected and potentially untrusted source.
Detects potential malicious email execution chains where Microsoft Outlook spawns suspicious child processes (e.g., powershell.exe, cmd.exe, wscript.exe, cscript.exe, mshta.exe).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
The rule further inspects command-line arguments and script contents for high-risk behaviors such as encoded PowerShell commands (-enc), execution of macro-enabled files (.docm, .xlsm, .js), or the presence of web download functions (DownloadFile, Invoke-WebRequest).
This pattern is strongly associated with malware delivery via phishing emails, macro exploitation, and initial access techniques mapped to MITRE ATT&CK T1566 (Phishing) and T1204 (User Execution).
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components. This rule specifically looks for `conhost.exe` spawning `cmd.exe`, `cscript.exe`, `mshta.exe`, `powershell_ise.exe`, `powershell.exe`, `pwsh.exe`, `regsvr32.exe`, or `wscript.exe`.
Detects the execution of the HTML Help executable (hh.exe) followed closely by the execution of mshta.exe loading a remote resource. This pattern is indicative of a malicious CHM file being used to launch a remote HTA file, a technique observed in a campaign delivering Amatera Stealer and PureMiner.
This analytic detects suspicious use of 'mshta.exe' or 'rundll32.exe' invoking 'mshtml.dll' or the 'RunHTMLApplication' export without including a direct HTTP/HTTPS URL in the command line. This pattern could be associated with obfuscated script execution used by threat actors during initial access or payload staging. The absence of a visible URL may indicate attempts to evade static detections by embedding the URL via string concatenation, encoding (e.g., hex), or indirect script loaders like 'GetObject()'.
Page 16 of 21