Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,008 detections
Filters
Last updated
All Time
Detection languages
1,930
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,437
11,828
5,871
5,150
4,864
4,008
Platforms
3,584
660
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,296
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects the execution of Windows Script Host (WScript.exe or CScript.exe) that creates a file or folder starting with 'Libs_' within the 'C:\Users\Public\' directory. This activity is often associated with attackers staging payloads, configuration files, or tools in publicly writable folders to evade detection.
Detects instances where the Notepad++ executable is launched from a location within the C:\Users\Public\ directory, specifically when the parent process is a Windows scripting engine (wscript.exe or cscript.exe). This pattern is often indicative of an adversary executing a malicious payload staged in a common public directory using script-based wrappers to bypass execution policy or maintain stealth.
This rule detects instances where Windows script hosts (wscript.exe or cscript.exe) create directories with suspicious naming conventions (starting with 'Libs_' or containing 'Temp Documents') within the 'C:\Users\Public\' directory. This activity is often associated with the staging of malicious payloads or collected data prior to exfiltration or execution.
Detects instances where the Windows Script Host (wscript.exe) spawns a process to open a PDF file located within the Public user's 'Temp Documents' directory. This behavior is indicative of a potential malware staging or execution attempt where an adversary attempts to open a malicious document from a publicly accessible folder to bypass user suspicion or execute malicious content.
Detects VBScript droppers that utilize excessive 'WScript.Sleep' delays to bypass sandbox analysis, often combined with error suppression and downloader APIs to execute malicious payloads.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects instances where WScript or CScript (Windows Script Host) spawns PowerShell with common obfuscation and persistence flags, specifically executing in a hidden, non-interactive, headless, and encoded command mode. This pattern is commonly used by malicious scripts (e.g., VBScript or JScript) to execute secondary payloads while minimizing visual indicators on the host.
Detects the use of rundll32.exe or regsvr32.exe to execute code via remote scripts, COM scriptlets, or JavaScript. This technique is often used in fileless malware or to bypass execution policies by loading scripts directly from a URL or local file.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
This rule detects potentially malicious activity involving the execution of Node.js scripts initiated by system script proxies (wscript, cscript, msiexec) within specific paths, often associated with subsequent installation of VBScript agents or direct network communication with a known command-and-control IP address.
This rule detects a multi-stage attack chain involving the execution of a script (likely config.cmd) via curl, followed by the modification of the Active Setup StubPath registry key for persistence, and subsequent execution of a Python script (config.py) from a non-standard location in AppData\Local\Microsoft\.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects the execution and behavioral patterns associated with the malicious 'indexed-btree' npm package. The rule specifically looks for code patterns where a malicious loader is injected into 'BTree.prototype.set' and triggered at runtime. It also monitors for suspicious process spawning behavior, such as running node processes with detached and hidden windows flags, often used by the package to maintain persistence or execute malicious payloads silently.
This rule detects potentially malicious activity involving Node.js modules. It monitors for the deletion of specific 'sharedLoad.min.js' or 'extended' files within 'node_modules' directories, the execution of Node.js processes attempting file deletion operations (like 'unlink' or 'rm') within 'node_modules', and the creation or modification of JavaScript files within 'node_modules' that contain 'btree' references. This activity may indicate an attempt to tamper with application dependencies, inject malicious code, or remove artifacts.
Detects instances where a Node.js process (node.exe) attempts to execute native system discovery commands such as systeminfo, hostname, or wmic queries. This pattern is commonly observed in malicious Node.js applications or compromised environments attempting to gather system reconnaissance information.
Detects execution patterns indicative of 'ClickFix' social engineering, where a user is tricked into copying a command to their clipboard and executing it directly in a terminal. The rule monitors for processes that read clipboard contents (via PowerShell or clip.exe) and simultaneously invoke shell interpreters to execute the retrieved data.
Detects potential supply chain attacks where a common external script (e.g., a widget) is loaded across multiple unrelated domains, followed by correlation with suspicious user-executed commands indicative of 'ClickFix' tactics (copying and pasting malicious code from a browser-based overlay into the Windows Run dialog).
Detects a potential ClickFix delivery attack where a user navigates to an automotive-themed website, interacts with the system via the Windows Run dialog (RunMRU), and subsequently executes command-line interpreters (powershell, cmd, wscript, mshta) spawned by explorer.exe within a short time window.
Detects AI coding assistants and LLM agent frameworks spawning shell processes or interpreters to execute potentially malicious commands. The rule monitors for suspicious activity often associated with download cradles, credential access, reconnaissance, or persistence, while excluding standard interactive terminal usage.
Page 25 of 191