Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
71 detections
Filters
Last updated
All Time
Detection languages
30
24
10
2
2
Contributors
20
14
10
9
6
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
71
1
Products / Services
38
22
4
3
2
MITRE Techniques
65
53
9
6
5
CVEs
4
1
IDS Classtypes
1
IDS Protocols
1
Detects activity associated with the RoguePlanet exploit, which involves creating EICAR content and NTFS Alternate Data Streams (ADS) within specific staging directories (wdtest_temp or RP_<UUID>). This behavior is intended to trigger Windows Defender scans and induce a TOCTOU race condition (CVE-2026-50656) by manipulating file operations near the wermgr.exe process.
Detects the creation of an NTFS Alternate Data Stream (ADS) named :WDFOO on the wermgr.exe process within RP_* staged directories. This behavior is a specific indicator of the RoguePlanet exploit (CVE-2026-50656), which leverages an ADS write to trigger a Microsoft Defender on-access scan and facilitate a TOCTOU (Time-of-Check to Time-of-Use) race condition for privilege escalation or exploitation.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects WinRAR creating a malicious VBS/VBE script within the Windows Startup folder using NTFS Alternate Data Streams, a behavior associated with the exploitation of CVE-2025-8088 by the Gamaredon threat group.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
Detects suspicious access to wermgr.exe involving Alternate Data Streams (ADS) using the WDFOO tag, or access via Volume Shadow Copy (VSS) paths, often indicative of exploitation attempts related to CVE-2026-50656 where an adversary uses oplocks for race conditions against Windows Defender.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
This rule detects the creation of suspicious NTFS Alternate Data Streams (ADS) commonly associated with malicious activities. Specifically, it monitors for the use of the ':WDFOO' stream name within temporary directories, which is a known indicator of certain malware or post-exploitation staging behaviors. Additionally, it identifies attempts by 'wermgr.exe' (Windows Error Reporting Manager) to interact with temporary files in these paths, which may suggest masquerading or living-off-the-land techniques.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
This rule monitors for suspicious activity involving wermgr.exe and Windows Defender quarantine directory. It detects wermgr.exe being written to or executed from non-standard temporary paths (often associated with potential junction-redirected payload execution), non-MsMpEng processes writing to the Windows Defender quarantine folder, and the creation of NTFS Alternate Data Streams (ADS) named :WDFOO within temporary directories.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects NTFS ADS used to hide malicious payloads from standard directory listings
This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.
Detects the download of suspicious file type from URLs with IP
Detects potential suspicious winget package installation from a suspicious source.
Page 2 of 4