Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Hades Bun Payload Execution
Cortex XDR
Detects the execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This indicates potential malicious activity associated with the Hades PyPI campaign.
Detects process command lines executing an `_index.js` payload using the Bun runtime, which is characteristic of the Hades stealer's execution chain where a Python loader downloads Bun to execute an obfuscated JavaScript payload.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects suspicious command-line activity involving 'cscript' or 'wscript' (Windows Script Host) combined with keywords like 'download', 'execute', or 'powershell'. A high count of such events (3 or more within 5 minutes) from the same computer and account is flagged, indicating potential exploit kit activity, malicious script execution, or initial access attempts.
Detects wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags. This pattern is used by JS.MonoGlyphRAT to decrypt and execute AES-encrypted payloads while evading static analysis.
Detects creation of AI coding assistant configuration files used by the Miasma worm
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
for persistence. The malware injects setup scripts into .claude, .cursor, .gemini,
and .vscode directories that execute via Bun on IDE open.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
Detects instances where node or Electron processes are executed with the ELECTRON_RUN_AS_NODE environment variable set to 1. This technique is used by UNK_DeadDrop to turn an editor into a plain Node.js interpreter for stealthy payload execution.
Detects wscript.exe (or cscript.exe) executing a JavaScript file from the C:\Users\Public\ directory. This behavior is indicative of the relocated JScript loader stage observed in a recent malspam .NET loader campaign.
Detects execution of the Bun runtime passing '_index.js' as a target, matching the Hades PyPI campaign loader behavior. This campaign leverages malicious `*-setup.pth` files to download Bun and run an obfuscated JavaScript credential stealer.
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.
Detects the execution of wscript.exe loading a script file from the C:\Users\Public\ directory, a behavior observed in the DesckVB RAT staging process. This technique is often used by adversaries to execute malicious scripts from a commonly accessible location.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Detects the execution of the Deno runtime attempting to fetch and run a remote script using the '-A' (allow all permissions) flag combined with an HTTP/HTTPS URL, a known behavior of the DinDoor backdoor and other malicious Deno abuse.
Detects installation or update of a VSCode extension from an unapproved publisher by monitoring for vsce-sign.exe signature verification events in DeviceProcessEvents. VSCode invokes vsce-sign.exe once per extension install or auto-update to verify the extension's marketplace signature before extraction. The full extension slug is passed as the --package argument, making this a reliable, install-time signal that fires for all extension types regardless of whether the extension has a background process or language server.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Extensions are evaluated against an approved publisher list maintained as an embedded datatable. Publishers are matched on the prefix before the first . in the extension slug (e.g., ms-python from ms-python.python), allowing publisher-level approval rather than per-extension management.
This detection was developed in response to the TeamPCP supply chain campaign (May 2026), in which malicious VSCode extensions were distributed via fake GitHub issue notifications targeting developers.
Detects unusual JavaScript-related URI query parameters in Exchange IIS logs accessing the OWA directory. This may indicate attempted exploitation of the CVE-2026-42897 XSS vulnerability.
This rule detects the download of JavaScript (.js) or HTML Application (.hta) files followed by the execution of scripting interpreters like mshta, cscript, wscript, node, or powershell with encoded commands on the same device within a one-hour window. It assigns a score based on the count of downloaded files and executed scripts, triggering an alert if the combined score exceeds 2. This behavior is indicative of potential malicious script execution, often seen in initial access or execution phases of an attack.
Page 24 of 34