Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation of a file named 'RemComSvc.exe', which is the default service executable name used by the RemCom utility. The presence of this file typically indicates the installation and execution of RemCom on a Windows system, often for remote administration or malicious purposes.
Detects the creation of a suspicious file by 'svchost.exe' in the 'Personalization\LockScreenImage' directory, specifically looking for files that are not in the 'C:\Windows\' directory and do not have common image extensions like '.jpg', '.jpeg', or '.png'. This behavior can indicate an adversary attempting to download or stage malicious files using the 'desktopimgdownldr' functionality, which is often associated with T1105 (Ingress Tool Transfer).
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects the creation of the LiveKD driver (LiveKdD.SYS) by any process other than the legitimate LiveKD executables (livekd.exe or livek64.exe). This could indicate an attempt to load a malicious or unauthorized driver using a renamed or masqueraded process.
Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
This rule detects the creation of a dump file by the password dumper tool QuarksPwDump. Specifically, it looks for files created in the 'AppData\Local\Temp\' directory with names starting with 'SAM-' and ending with '.dmp'. This pattern indicates that QuarksPwDump is attempting to dump the Security Account Manager (SAM) database, which contains local user credentials.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Detects the creation of Usage Log files by the CLR (clr.dll) for specific system binaries. These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context. This activity can be indicative of defense evasion techniques where adversaries use trusted binaries to proxy execution of malicious code, and the CLR usage logs can reveal this activity.
This rule detects suspicious file creation activity involving 'colorcpl.exe'. Specifically, it looks for instances where 'colorcpl.exe' is the image creating files in the 'c:\windows\system32\spool\drivers\color\' directory, excluding common color profile file extensions like '.icm', '.gmmp', '.cdmp', and '.camp'. This behavior is indicative of an adversary attempting to hide malicious files within a legitimate system directory by abusing the color management control panel utility.
Detects the creation of '.diagcab' files, which can be used by legitimate installers but also by adversaries for exploitation or data collection. The rule suggests reviewing the filename and its location for further investigation.
This rule detects the creation of executable files (.exe) within the `C:\Windows\WinSxS\` directory by processes that are not located in standard system directories (`C:\Windows\Systems32\`, `C:\Windows\SysWOW64\`, or `C:\Windows\WinSxS\`). This behavior can be indicative of malware attempting to establish persistence or execute from a less commonly monitored system directory, potentially mimicking legitimate system components.
Detects the creation of a file named 'livekd.dmp' in the 'C:\Windows\' directory, which is the default output file for LiveKD kernel memory dumps. This activity can indicate an attempt to perform live kernel debugging, potentially for privilege escalation or defense evasion purposes.
Detects the creation of Process Explorer drivers by processes other than Process Explorer itself. This activity can indicate that hack tools or malware are attempting to use the Process Explorer driver for privilege escalation, often by dropping the driver to disk, running a service with it, and then removing it.
Detects the creation of a DLL file by "dllhost.exe" in the System32 directory, which is indicative of the "IDiagnosticProfileUAC" UAC bypass technique. This technique leverages a legitimate Windows process to write a malicious DLL into a system directory, allowing for privilege escalation.
Detects the creation of specific files (winsat.exe or winmm.dll) in a user's temporary directory under a 'system32' subdirectory. This pattern is indicative of a User Account Control (UAC) bypass technique that exploits a path parsing vulnerability in winsat.exe, often associated with UACMe (specifically UACMe method 52). The rule looks for files created in 'C:\Users\<username>\AppData\Local\Temp\system32\' with the names 'winsat.exe' or 'winmm.dll'.
This rule detects the creation of a file named 'lsass.exe.dmp' within the 'C:\Windows\System32\config\systemprofile\AppData\Local\CrashDumps\' directory. This specific file pattern and location are indicative of an attempt to dump the LSASS process memory, which often contains sensitive credential material. Adversaries frequently use this technique to extract credentials for lateral movement or persistence. The rule specifically references the 'LSASS Shtinkering' technique, which abuses Windows Error Reporting to achieve LSASS memory dumping.
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Detects the creation of the LiveKD driver file (LiveKdD.SYS) by the LiveKD or LiveK64 executables. LiveKD is a tool used for live kernel debugging, which can be leveraged by adversaries for defense evasion or privilege escalation by interacting directly with the kernel.
Detects a potential privilege escalation attempt by monitoring the creation of specific ".Exe.Local" folders within the "System32" directory. This technique is used to sideload "comctl32.dll" into legitimate Windows processes, which can lead to privilege escalation or persistence.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
Page 216 of 217