Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
Identifies execution of the mshta LOLBAS utility with command arguments containing the http/https or ftp keyword, which could indicate that an attacker is executing a remotely hosted malicious file for possible code execution AND/OR attempting to ingress a file. Seen in campaigns like lumma stealer.
Detects execution of mshta.exe from explorer.exe with an inline HTA script that reads and executes code from the registry.
Detects suspicious execution of mshta.exe from cmd.exe with embedded JavaScript and registry modifications.
Detects execution of mshta.exe with inline scripting using protocol handlers (vbscript, javascript, about)
KQL Query from file: FileFix Detection
KQL Query
KQL Query
KQL Query
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
Detects potentially suspicious subprocesses such as LOLBINs spawned by web browsers. This activity could be associated with the "FileFix" social engineering technique, where users are tricked into launching the file explorer via a browser-based phishing page and pasting malicious commands into the address bar. The technique abuses clipboard manipulation and disguises command execution as benign file path access, resulting in covert execution of system utilities.
KQL Query from file: Threat Hunting Mshta with Sentinel TI
KQL Query from file: Suspicious MSHTA Usage
This rule detects the manual execution of a script from inside a compressed file (ZIP/RAR) on Windows. It identifies scenarios where a user interacts with a compressed file, causing a script to be extracted to a temporary directory and then executed by common scripting interpreters like cscript, wscript, powershell, pwsh, or mshta. The rule covers execution initiated by 7zip, WinRar, or the native Windows File Explorer.
Detects the execution of mshta.exe to fetch and run remote scripts, a technique used by TAG-140 for initial access and loading the BroaderAspect loader and DRAT V2. This activity is often initiated via social engineering lures.
Detects suspicious process creation where a web browser spawns a command interpreter or scripting host. This behavior is indicative of the "FileFix" attack, where users are socially engineered to paste malicious commands into the File Explorer address bar opened by a browser's file upload functionality.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file
Detects potential LethalHTA technique where the "mshta.exe" is spawned by an "svchost.exe" process
Detects activity that could be related to Baby Shark malware
Detects remote thread creation from CACTUSTORCH as described in references.
Page 18 of 21