Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Detects a loader writing an encrypted data component and immediately querying hostname, processor, or volume identifiers used to derive a machine-specific decryption key. This behavior is indicative of malware, such as RokRAT, attempting to create a system-specific payload to evade detection or ensure persistence.
This rule detects PowerShell processes attempting to retrieve or execute content from a remote RTF (Rich Text Format) resource. It specifically looks for PowerShell commands like 'Invoke-WebRequest', 'iwr', 'DownloadString', 'Invoke-Expression', or 'iex' that are directed towards a URL ending with '.rtf'. This behavior is often associated with malicious activity where RTF files are used as a delivery mechanism for scripts.
Affair-Build Script Restarting VDS
Cortex XDR
This rule detects the execution of `cmd.exe`, `powershell.exe`, or `pwsh.exe` that includes the command-line arguments related to an 'affair-build.bat' script or directly stopping/starting the Virtual Disk Service (VDS) using `net` or `sc` commands. It aims to identify cleanup or persistence script sequences that manipulate the VDS.
Detects the execution of base64 decoded strings directly outputted from scripting processes, which is a common technique for obfuscation and payload delivery.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Detects connections to temporary Cloudflare quick tunnel endpoints initiated by VBS scripts.
Detect Tiny Vbs
YARA
This YARA rule detects Visual Basic Script (VBS) files that contain common keywords often used in malicious VBScripts. Specifically, it looks for the presence of 'Dim' (for variable declaration), 'Wscript.Shell' (to interact with the operating system shell), 'End Function' (a VBScript construct), and 'CreateObject' (to create COM objects). The rule is designed to identify potentially malicious VBS files, possibly used for execution, persistence, or other adversarial activities.
Detects wscript.exe running JavaScript payloads dropped specifically into the AppData\Local\Temp path, typical of SocGholish fake update execution.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects the execution of mshta.exe when invoked with command-line arguments indicative of script execution (e.g., vbscript:, javascript:, http(s)://) or when spawned by common Microsoft Office applications. This behavior is frequently associated with malicious document-based attacks, where office macros trigger mshta to download or execute obfuscated code.
Detects suspicious execution patterns (such as encoded commands, downloading files via web clients, or using administration utilities) originating from third-party update, monitoring, or deployment agents. This behavior is indicative of a supply chain compromise or malicious activity leveraging trusted binaries to execute arbitrary code.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Detects a batch script attempting to delete itself using the 'del %~f0' command. This technique is often used by malicious scripts to remove forensic evidence after execution.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects the simultaneous extraction of at least three different script types (VBS, PS1, JS, or DAT) from archives, followed by their execution by their respective interpreters (wscript.exe, powershell.exe, node.exe, or bun.exe). This behavior is indicative of multi-stage attacks where adversaries use various scripting languages for different phases of their operations, often to evade detection or to ensure compatibility across different system configurations. The inclusion of '.dat' files suggests that the rule is also looking for potentially obfuscated or custom script formats that are then interpreted by one of the listed executables.
Detects anomalous node.exe execution initiated by command-line shells (cmd.exe or powershell.exe) where the command line contains either '-e' (for evaluating JavaScript code) or '.js' (indicating a JavaScript file execution). This behavior is associated with the NodeSnake cross-platform downloader, which uses Node.js to execute its payload, as observed in campaigns linked to Interlock and Rhysida.
Detects the execution of 'osascript' with command-line arguments indicative of malicious activity, such as attempting to access locked icons, using 'dscl . authonly' for authentication, or displaying hidden dialogs for credential harvesting. This often points to AppleScript abuse for various attack techniques.
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Page 123 of 191