Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects Visual Studio Code spawning common command-line shells or interpreters (cmd.exe, powershell.exe, python, etc.) with suspicious command-line arguments, such as network download utilities (curl, wget, Invoke-WebRequest) or potentially malicious obfuscated/long arguments, which may indicate developer environment exploitation or software supply chain attacks.
This rule detects the execution of common command-line tools (npm, node, or go) where the command arguments contain known malicious or suspicious strings associated with recent supply chain or exploitation activity (such as malicious npm packages, specific GitHub repositories, or unusual file path access).
This rule monitors for suspicious activity associated with Flowise Model Context Protocol (MCP) implementations, specifically detecting environment variable bypasses using Node.js --require, potential Server-Side Request Forgery (SSRF) attempts targeting internal infrastructure and cloud metadata services, and the creation of known proof-of-concept (PoC) artifacts.
Detects the execution of a JScript file by cscript.exe using a legacy NTFS 8.3 shortname format. This is a specific behavior observed in Gootloader's persistence mechanism, where a .LNK file in the Startup folder executes a second-stage script.
Detects process execution patterns associated with the Grandoreiro banking trojan, specifically the launching of browsers in kiosk mode for overlay attacks or the execution of suspicious non-UI binaries from scripts (wscript/cscript/mshta) located in user-writable directories.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Detects a Node.js process spawning a detached JavaScript file with a randomly generated 24-character hexadecimal filename in a temporary directory. This behavior is indicative of the stage-2 payload execution observed in the Mastra npm supply chain attack (easy-day-js typosquat).
Detects execution of common script interpreters (wscript.exe, cscript.exe, powershell.exe, mshta.exe) where the command line argument references a file residing on a drive letter path (e.g., C:\, D:\). This pattern is often used in the execution of downloaded payloads or local malicious scripts.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Detects execution of rundll32.exe with suspicious arguments or from non-standard file paths, often used to proxy malicious code execution, load scripts (JavaScript), or execute arbitrary DLLs from user-writable directories. The rule includes filters to exclude legitimate Windows system operations.
Detects execution of rundll32.exe with suspicious arguments or from non-standard file paths, often used to proxy malicious code execution, load scripts (JavaScript), or execute arbitrary DLLs from user-writable directories. The rule includes filters to exclude legitimate Windows system operations.
Detects instances where common web browsers initiate secondary processes such as command-line interpreters (cmd.exe, powershell.exe) or scripting engines (wscript.exe, cscript.exe, mshta.exe). This pattern is frequently indicative of drive-by download attacks or initial access where an adversary uses web browser activity to execute malicious scripts or commands.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects suspicious activity indicative of CryptoBandits malware, specifically JScript stealer polling the clipboard and beaconing actions. This rule identifies instances where wscript.exe or cscript.exe spawn clip.exe (for clipboard access), curl.exe (for C2 communication via Tor SOCKS5 with specific keywords like 'REPL', 'SEED', 'PKEY'), or cmd.exe within a staging directory like 'Public\Documents'. It also looks for specific filenames in the command line such as 'exefu.js', 'ofolu.js', 'words.txt', or 'ugate.exe'.
Detects the creation of scheduled tasks from XML files in 'C:\Users\Public\Documents\' by 'schtasks.exe' and subsequent execution of JavaScript payloads via 'wscript.exe' or 'cscript.exe' from the same public documents directory. This activity is attributed to the CryptoBandits threat group.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects behavior associated with the 'Adblock for YouTube' browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) involving the injection of arbitrary JavaScript into the MAIN world of web pages. This occurs via remotely fetched script rules and the use of 'trusted-create-element' or similar methods to bypass browser sandboxing for script tag insertion and DOM access.
Detects the BadBlocker Adblock for YouTube extension (cmedhionkhpnakcndndgjdbohmhepckk) leveraging chrome.scripting.executeScript to inject server-fetched JavaScript into the MAIN world of web pages, specifically utilizing the 'trusted-create-element' scriptlet to facilitate this behavior.
Detects Chrome extension package files associated with the 'BadBlocker' Adblock for YouTube campaign, identifying malicious indicators such as specific remote fetch logic ('scripletsRules'), Unistream SDK integration, and execution patterns that abuse browser extension functionality to bypass security controls or fetch remote content.
Detects obfuscated JavaScript code indicative of STRRAT malware.
Page 21 of 34