Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
434 detections
Filters
Last updated
All Time
Detection languages
205
119
33
24
18
Contributors
91
70
52
38
25
Categories
329
260
202
41
40
Platforms
424
6
4
4
1
Products / Services
167
126
91
19
9
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
2
2
2
1
1
IDS Classtypes
4
IDS Protocols
3
1
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects obfuscated PowerShell scripts that utilize 'mshta' for execution, often seen in defense evasion tactics. The rule specifically looks for a combination of keywords in PowerShell script block logs, indicating the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' which are characteristic of Invoke-Obfuscation techniques involving MSHTA.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects obfuscated PowerShell execution leveraging MSHTA. This technique is often used for defense evasion by adversaries to execute malicious scripts without directly invoking PowerShell. The rule specifically looks for a combination of keywords indicative of this method, including 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)' within the PowerShell module payload.
Detects obfuscated PowerShell execution leveraging MSHTA. The rule specifically looks for command-line arguments that indicate the use of 'set', '&&', 'mshta', 'vbscript:createobject', '.run', and '(window.close)', which are common patterns in MSHTA-based PowerShell obfuscation.
This rule detects the execution of JavaScript code using 'mshta.exe'. Mshta.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious .hta files and JavaScript or VBScript, often to bypass application control solutions or browser security settings. The rule specifically looks for 'mshta.exe' as the image or original filename and the presence of 'javascript' in the command line arguments.
This rule detects suspicious execution patterns of mshta.exe, a Microsoft HTML Application host. It specifically looks for mshta.exe being spawned by common scripting or system utilities (cmd.exe, powershell.exe, cscript.exe, wscript.exe, regsvr32.exe, rundll32.exe) or when mshta.exe is executed from suspicious directories like AppData, ProgramData, Users\Public, or Windows\Temp. The rule also flags executions involving .htm or .hta files in the command line, while filtering out legitimate executions from System32 or SysWOW64 directories.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
Detects the execution of script interpreters (cscript.exe, mshta.exe, wscript.exe) with suspicious command-line flags or from temporary folders or folders accessible by environment variables, which is a common technique used by adversaries for execution and persistence.
This rule detects the execution of 'mshta.exe' with command-line arguments containing URL schemes like 'http://', 'https://', or 'ftp://'. This behavior is indicative of an attacker attempting to execute a remotely hosted HTML Application (HTA) file, which can be used for malicious purposes such as code execution or bypassing security controls. Attackers often leverage mshta.exe as a living-off-the-land binary (LOLBIN) to execute scripts or download additional payloads from remote servers.
Detects a potential LethalHTA technique where 'mshta.exe' is spawned by an 'svchost.exe' process. This parent-child relationship is unusual and can indicate the abuse of mshta.exe for code execution, often bypassing application controls.
Detects execution of javascript code using "mshta.exe".
Detects execution of the "mshta" utility with an argument containing the "http" keyword, which could indicate that an attacker is executing a remotely hosted malicious hta file
Page 21 of 21