Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.
Detects the execution of wscript.exe or cscript.exe with the '--update' command-line flag, a technique used by the FrostyNeighbor JavaScript dropper to transition to its second execution phase (PicassoLoader).
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook
execution, daemonized Node.js processes, and PyPI payload execution.
execution, daemonized Node.js processes, and PyPI payload execution.
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
Detects file creation events associated with the Mini Shai-Hulud npm/PyPI supply-chain attack campaign targeting TanStack, Mistral AI, OpenSearch, and Guardrails AI packages.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook execution and daemonized Node.js processes.
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
PhantomRaven Temporary Payload Creation
Cortex XDR
Detects Node.js dropping the PhantomRaven dynamic Stage-3 payload into the /tmp directory. The attack utilizes a file-based temporary dropper that operates outside of standard NPM package paths, bypassing static code analysis.
Detects the execution of WMIC with the "format" flag to potentially load local XSL files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses.
Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects remote thread creation from CACTUSTORCH as described in references.
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Detects wscript/cscript/mshta executions of scripts located in user directories
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Page 25 of 34