Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects frequent execution (3 or more within an hour) of .vbs or .vbe scripts via wscript.exe or cscript.exe where the command line contains keywords suggestive of lure documents such as invoices, payments, or reports. This behavior is commonly associated with malware droppers or phish-delivered scripts.
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects ClearFake PowerShell stager using 'iex' (Invoke-Expression) and 'irm' (Invoke-RestMethod) with '-UseBasicParsing'. This combination is often used by malware to download and execute scripts from the internet, bypassing more robust parsing mechanisms.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
Detects Python scripts leveraging secret-tool or DBus on Linux to dump GNOME keyring passwords (UNK_DeadDrop). The rule specifically looks for the 'secret-tool' process being initiated by 'python' or 'python3'.
Identifies the use of wscript.exe to execute VBScript files that are disguised as Realtek audio settings, specifically looking for 'ResetRealtekAudioSettings64' in the command line. This pattern is associated with AsyncRAT.
Detects the execution of hidden VBS files launched directly via VS Code automation on Windows, specifically looking for 'wscript.exe' executing a VBScript with 'run-update-hidden-launch.vbs' in its command line.
Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.
Detects the use of PowerShell with 'Invoke-WebRequest' to download trojanized installers (MicrosoftEdgeSetup.exe, ChromeSetup.exe, MSTeamsSetup.exe) from malicious domains like 'apple-online.shop' or 'trycloudflare.com', as observed in Interlock activity leveraging JunkFiction.
Detects execution of custom PowerShell phishing tools (first.ps1, main1.ps1) that present fake Windows update screens to steal local credentials. This rule specifically looks for PowerShell processes where the command line contains 'CredPhish' and either 'main1.ps1' or 'first.ps1'.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Detects VBScript (wscript.exe or cscript.exe) attempting to create Windows services using 'sc.exe create' or adding new users using 'net user /add'. This behavior is often associated with persistence mechanisms or privilege escalation by malicious scripts.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
Page 117 of 191