Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
Detects WMI or PowerShell queries against SecurityCenter2, Defender status, registered antivirus products, or endpoint agents before staging the payload. This rule specifically looks for process executions of powershell.exe or wmic.exe where the command line contains keywords related to security products like 'SecurityCenter2', 'AntiVirusProduct', 'Get-MpComputerStatus', 'Win32_Product' combined with terms like 'defender', 'antivirus', 'edr', or 'security'.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
This rule detects PowerShell commands or script block executions involving the creation of desktop shortcuts associated with the VILE ransomware decryptor. The rule specifically looks for the usage of WScript.Shell, the -NoProfile flag, and references to 'vile_Decryptor' or 'vile_icon.ico' in the command line or script content.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Detects the execution of a PowerShell script named 'sp.ps1' which has been associated with the Seedworm (also known as Sandworm Team) threat group for gathering screenshots. This rule specifically looks for 'sp.ps1' within process command lines.
Detects scripts combining AllocConsole and ConsoleWindowClass to explicitly hide application windows. This technique can be used by adversaries to conceal their malicious activity.
Identifies browsers executing highly obfuscated Tycoon2FA JavaScript payloads utilizing eval or specific array mapping functions to hide the phishing kit logic, specifically when interacting with authentication or login pages.
Detects the execution of 'tango13.ps1', a PowerShell payload associated with the Iranian APT group MuddyWater (also known as Seedworm or APT33), which has been observed being dropped via Microsoft Teams.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Identifies execution of 'c2_fixed.py' or 'c2_fixed_v2.py' used in MuddyWater C2 operations. These scripts are associated with the MuddyWater threat group for command and control activities.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.
Detects the execution of Python or Node.js processes that include command-line arguments indicative of base64 decoding or zlib decompression, often used for deobfuscating and executing malicious payloads in memory.
Detects the execution of .bat or .cmd scripts disguised as VPN installer components utilizing curl or wget to pull down malware.
Monitors wscript executing payloads with specific GammaLoad parameter switches associated with the Gamaredon APT group.
Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.
Page 118 of 191