Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
This rule detects suspicious script execution on macOS devices that targets known cryptocurrency wallet applications or data files. It looks for command-line executions involving common shell interpreters (sh, bash, zsh, osascript) that contain strings associated with Ledger Live, Trezor Suite, Exodus, Electrum, or generic 'wallet.dat' files. This activity could indicate an attempt to steal cryptocurrency wallet information or funds.
Identifies scripting engines (wscript.exe, cscript.exe, powershell.exe) executing payloads from temporary directories, which often indicates a drop-and-execute chain from a smuggled or packed file, commonly associated with phishing campaigns.
This rule detects initial access attempts involving double-extension shortcuts (.lnk) that lead to the execution of VBScript (VBS) files, which subsequently launch PowerShell scripts for decryption. The detection logic specifically looks for a .lnk file executing a command line containing '.vbs', followed within 5 minutes by a PowerShell process executing a command line containing 'Profile.ps1' or '-bxor'. This chain of events is indicative of malicious activity often used in phishing campaigns to bypass security controls and execute obfuscated payloads.
Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
This rule detects when the WMI provider host process (wmiprvse.exe) spawns common scripting interpreters or command-line shells such as cmd.exe, powershell.exe, or wscript.exe. This behavior is a common indicator of remote command execution via WMI, often used by adversaries for lateral movement, remote code execution, or persistence within a Windows environment.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects attempts to delete Volume Shadow Copies (VSS) using standard Windows utilities like vssadmin.exe, wmic.exe, or PowerShell commands. This behavior is a common tactic employed by ransomware to inhibit system recovery and prevent the restoration of encrypted files.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects the execution of mshta.exe with arguments that indicate the loading of remote HTML applications (HTA) via HTTP/HTTPS, UNC paths, or the execution of inline JavaScript/VBScript commands. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary to bypass security controls or fetch malicious payloads.
This rule identifies the execution of MeshCentral for remote command execution, specifically looking for command-line arguments containing 'meshctrl.js' and 'RunCommand'. This activity has been observed in attacks such as those by ShinyHunters to stage payloads on compromised Oracle PeopleSoft servers.
Detects deno.exe executing inline scripts via 'eval', indicating DINODANCE/Tsundere malware execution. This behavior is associated with the MuddyWater APT group.
Detects anomalous script interpreters referencing CredUIPromptForWindowsCredentialsW to spoof password prompts. This function is typically used to display a credential prompt to the user. Its presence in the command line of scripting tools like PowerShell, cmd, or Python suggests an attempt to spoof legitimate credential prompts, potentially for phishing or credential harvesting.
Detects recursive listing or search commands targeting OneDrive directories from a shell or script interpreter. This activity could indicate an attacker attempting to discover sensitive files within a user's OneDrive.
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Detects execution of specific AutoHotkey (AHK) scripts associated with AsyncRAT, where threat actors abuse AHK to reflectively inject .NET remote access trojans.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects modifications to the registry re-enabling Windows Script Host to execute VBS payloads, often associated with malware like AsyncRAT.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
Page 121 of 191