Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Distinct scripts can not look dangerous based on their extension, but they are still executable files. In environments with macOS, Linux, WSL, Git Bash or Python Launcher, this can help to identify scripts renamed to hide their real purpose.
Detects wscript.exe spawning PowerShell with encoded command from C:\Temp.
Detects users copy-pasting PowerShell commands from fake 'system error' prompts.
Detects the infostealer disabling ETW and AMSI by setting the m_enabled flag to 0 in memory.
Detects the execution of VBScript or JScript files (via wscript.exe or cscript.exe) where the command line contains common VBScript argument handling keywords. This pattern can indicate malicious script execution attempting to parse arguments for further actions, potentially as part of a phishing attack or malware execution chain.
Detects suspicious process execution patterns associated with the Miasma worm, which attempts to scrape GitHub Actions Runner.Worker process memory to extract masked secrets. This rule looks for specific command-line arguments used by memory dumping tools or scripts targeting the GitHub Actions Runner.Worker process, including `grep` for secret JSON structures, `python` targeting `/proc/pid/mem`, and specific shell pipeline combinations observed in Miasma payloads.
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects PowerShell executing base64 encoded payloads or the string "I am not a robot" typically associated with FakeCaptcha malware found in the clipboard. This rule specifically looks for these indicators within the process command line of PowerShell or pwsh processes.
Detects the execution of Invoke-SMBRemoting for fileless lateral movement, specifically looking for PowerShell processes with 'Invoke-SMBRemoting' in their command line.
Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.
Detects PowerShell compressing stolen data prior to POST exfiltration. This rule specifically looks for the execution of 'powershell.exe' or 'pwsh.exe' with command-line arguments that include 'Compress-Archive', 'Invoke-WebRequest', and '-Method POST'. This combination indicates an attempt to compress data and then exfiltrate it via an HTTP POST request.
This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.
Detects the execution of RegSvcs.exe initiated by a VBScript (wscript.exe or cscript.exe). This technique can be used by adversaries to bypass application control and execute malicious code.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects the creation of scheduled tasks or 'at' jobs initiated by VBScript engines (wscript.exe or cscript.exe). This behavior can be indicative of malicious activity, such as persistence mechanisms established by malware or phishing attacks that leverage VBScript to schedule future execution.
Page 125 of 191