Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
Detects the execution of 'Falcon_module63.vbs', a script associated with the Iranian APT group Seedworm (also known as APT33 or Shamoon). This VBScript is often used in the initial stages of an attack for reconnaissance or to establish persistence.
Detects 'gp_v7_reflective.py', a Python reflective loader for GodPotato evasion, associated with the MuddyWater threat group.
Correlates the drop of a 24-character hex .js file with its immediate execution by node.exe, indicating potential compromise via a supply chain attack like Mastra NPM.
Detects bun.exe executing scripts directly from remote URLs, a common fallback behavior for these worms.
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects a hidden PowerShell stage creating a process through Start-Process, WMI, reflection, or .NET process APIs. This rule specifically looks for executable files spawned by PowerShell processes where the PowerShell command line contains keywords indicative of process creation methods like 'Start-Process', 'ProcessStartInfo', 'Win32_Process', 'CreateProcess', or 'Invoke-Expression'.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects modifications to the .bashrc file by unexpected scripts (node, python). Miasma uses this to ensure payloads run every time a user opens a new terminal.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects a backdoor querying adapter IP, processor ID, and device serial values in one sequence to derive a unique cloud folder identifier. This rule specifically looks for command-line executions of wmic, powershell, or cmd that contain strings related to Win32_NetworkAdapter, ProcessorId, SerialNumber, Win32_PhysicalMedia, or MACAddress.
Detects the simultaneous launching of a clean decoy PDF and a malicious script (specifically PowerShell) within the same second, often used by malware like AsyncRAT for distraction during execution.
Detects a Python runtime (such as userscreen.exe or python.exe) executing a file with a .cat extension. This technique is used by APT37 NarwhalRAT to conceal Python bytecode payloads.
Detects automated execution of hidden workspace scripts triggered upon opening IDE folders, specifically looking for bash or sh processes executing 'vendor/run-update.sh' initiated by VS Code or Cursor.
Detects instances where 'wt.exe' (Windows Terminal) is used to execute PowerShell or Command Prompt with suspicious command-line arguments often associated with initial execution vectors for ClickFix lures. Specifically looks for hidden window styles, bypass execution policy, or no profile arguments.
Detects PowerShell executing the CreateInstallServiceWork function with a custom FulfillmentPluginId, which is indicative of the UnCanny coercion technique.
Detects PowerShell invoking Windows.Internal.InstallService.Control to create an install work item via the UNCanny coercion primitive. This COM-based API call triggers the Windows Store Install Service to process a work item from an attacker-controlled UNC path, resulting in NTLM machine account coercion or SYSTEM-level DLL execution.
Detects scripts (Python/Node/VBS) directly accessing Chrome or OS-level DPAPI structures (Login Data, Cookies) to extract user credentials.
Identifies the core ClickFix vector: explorer.exe (via the Windows Run prompt) executing pasted PowerShell commands containing IEX and Get-Clipboard to execute the first stage.
Page 127 of 191