Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
103 detections
Filters
Last updated
All Time
Detection languages
45
36
8
6
4
Contributors
21
16
16
10
5
Categories
82
37
28
19
9
Platforms
99
3
1
1
Products / Services
43
27
20
11
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects the execution of PowerShell with specific flags to bypass execution policy and hide the window, commonly used to execute encoded payloads. This rule monitors for PowerShell processes spawned by suspicious parent processes such as 'cmd.exe' or 'ElevatorShellCode.exe' that include parameters like '-ep bypass', '-w hidden', and base64-encoded strings.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
Detects the execution of PowerShell with flags commonly used to obfuscate command lines or hide activity from the user, such as -EncodedCommand or -WindowStyle Hidden. These techniques are frequently used by adversaries to execute malicious scripts while avoiding detection.
Detects instances where AutoHotkey scripts launch Microsoft Edge or Google Chrome in headless mode. This behavior is indicative of automated browser manipulation, often used in credential harvesting, session hijacking, or automated interaction with web-based platforms by malicious entities such as UNC6692.
Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user, aiding in defense evasion.
This rule detects potentially malicious PowerShell or Command Prompt execution patterns by monitoring for suspicious command-line flags often used by malware for stealth, such as hidden windows, script policy bypasses, and file content retrieval from specific directories. It identifies processes that exhibit multiple risk-indicating characteristics, such as being launched from LNK files, using execution policy bypass flags, or performing remote file content access.
Detects instances where AutoHotkey scripts launch Microsoft Edge or Google Chrome in headless mode. This behavior is indicative of automated browser manipulation, often used in credential harvesting, session hijacking, or automated interaction with web-based platforms by malicious entities such as UNC6692.
Detects the execution of Node.js silently using 'conhost --headless', a technique used by EtherRAT and other malware to run malicious JavaScript payloads without displaying a console window to the user.
Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects SEO poisoning pages with hidden keywords to manipulate search rankings
Detects a sequence where a command shell (cmd.exe) is launched with minimized window flags to run PowerShell, followed by a PowerShell process executing code using common file-less loading techniques, specifically using Invoke-Expression (iex) on content retrieved via Get-Content from within the ProgramData directory.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
Detects the execution of Node.js silently using 'conhost --headless', a technique used by EtherRAT and other malware to run malicious JavaScript payloads without displaying a console window to the user.
Detects scripts combining AllocConsole and ConsoleWindowClass to explicitly hide application windows. This technique can be used by adversaries to conceal their malicious activity.
Detects processes launched with hidden window to avoid user detection
Detects processes launched with hidden window to avoid user detection
Suspicious Conhost Headless Execution
Cortex XDR
Detects the execution of conhost.exe (or conhost.ext) with the --headless parameter, a technique used in ClickFix campaigns to silently execute clipboard-injected commands.
Page 3 of 5