Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
172 detections
Filters
Last updated
All Time
Detection languages
68
50
14
13
10
Contributors
46
40
19
15
11
Categories
114
80
66
20
18
Platforms
157
7
3
2
2
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
139
123
118
97
36
CVEs
3
3
1
1
1
The following analytic detects the execution of VBScript using the wscript.exe application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because wscript.exe is typically not used to execute VBScript, which is usually associated with cscript.exe. This deviation can indicate an attempt to evade traditional process monitoring and antivirus defenses. If confirmed malicious, this technique could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
This rule detects the creation, modification, or deletion of scheduled tasks using specific task names known to be associated with the SVR-attributed GraphicalProton backdoor. The task names are designed to mimic legitimate Windows services to evade detection.
Detects when adversaries delete important scheduled tasks related to system restore, Windows Defender, BitLocker, Windows Backup, Windows Update, Update Orchestrator, or Exploit Guard. This activity could indicate an attempt to disrupt system services or processes, potentially as a precursor to data destructive activities or to hinder defensive capabilities.
Detects when adversaries delete important scheduled tasks using `schtasks.exe` to disrupt system functionality or security mechanisms. The rule specifically targets the deletion of tasks related to critical Windows components like BitLocker, ExploitGuard, SystemRestore, UpdateOrchestrator, Windows Defender, WindowsBackup, and WindowsUpdate, which can indicate an attempt to disable or interfere with essential system services or security features.
Page 9 of 9