Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
The analytic detects the execution of Windows shell processes initiated by WinRAR, such as "cmd.exe", "powershell.exe", "certutil.exe", "mshta.exe", or "bitsadmin.exe". This activity is significant because it may indicate exploitation of the WinRAR CVE-2023-38831 vulnerability, where malicious scripts are executed from spoofed ZIP archives. If confirmed malicious, this could lead to unauthorized access, financial loss, and further malicious activities like data theft or ransomware attacks.
The analytic detects the execution of mshta.exe via registry entries to run malicious scripts. It leverages registry activity logs to identify entries containing "mshta," "javascript," "vbscript," or "WScript.Shell." This behavior is significant as it indicates potential fileless malware, such as Kovter, which uses encoded scripts in the registry to persist and execute without files. If confirmed malicious, this activity could allow attackers to maintain persistence, execute arbitrary code, and evade traditional file-based detection methods, posing a significant threat to system integrity and security.
Detects the execution of malicious OneNote documents that contain embedded scripts. When a user clicks on a OneNote attachment and then on the malicious link inside the ".one" file, it exports and executes the malicious embedded script from specific directories.
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.
Detects updates to scheduled tasks (EventID 4702) where the new task content (`TaskContentNew`) contains suspicious keywords. These keywords include common temporary or user-writable directories often used by malware for staging or execution, combined with suspicious commands or scripting interpreters. This rule aims to identify adversaries establishing persistence or executing malicious code via scheduled tasks.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects obfuscated PowerShell execution via mshta.exe, specifically looking for patterns indicative of VBScript execution within mshta that creates an object and runs a command, often used for defense evasion.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects the creation of a new service where the ImagePath contains 'mshta' and 'vbscript:createobject', indicating potential obfuscated PowerShell execution via MSHTA. This technique is often used for defense evasion and execution.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
Detects the execution of Living Off The Land Binaries (LOLBINs) from an unusual or abnormal drive, such as a mounted ISO. This behavior can indicate an attempt by an adversary to evade detection by executing legitimate system tools from non-standard locations, often associated with initial access or defense evasion techniques.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects the creation of ".xml" and ".txt" files in folders within the "\AppData\Roaming\Microsoft" directory by specific uncommon processes. This behavior is associated with Devil Bait malware samples and stages as described by the NCSC.
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects a suspicious process spawning from an "mshta.exe" process, which could be indicative of a malicious HTA script execution. This rule specifically looks for common scripting and system utilities being launched as child processes of mshta.exe, which is often abused for defense evasion and execution.
Page 20 of 21