Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
59
33
9
3
3
Contributors
27
20
16
7
7
Categories
78
42
20
9
9
Platforms
100
9
5
2
1
Products / Services
34
28
15
4
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects when a process's command line contains 'ssl' or 'tls' and is observed at least 3 times within an hour on the same computer and by the same account. This could indicate various activities, including legitimate system processes, development activities, or potentially malicious use of SSL/TLS-related tools or scripts. The rule focuses on process creation events (EventID 4688) and analyzes the command line arguments.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects potential command injection attacks against AI agents through
suspicious prompt patterns or system command execution by AI processes.
suspicious prompt patterns or system command execution by AI processes.
Detects process doppelganging using NTFS transactional operations
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Detects anomalous frequency of UAC elevation prompts (consent.exe) initiated by PowerShell. This behavior is indicative of privilege escalation attempts, specifically matching the pattern of repeated Start-Process -Verb RunAs usage to solicit user interaction for UAC elevation.
Detects suspicious child processes spawned in a suspended state, indicative of process hollowing. The rule specifically targets legitimate Windows system processes (svchost.exe, explorer.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe, msiexec.exe, regsvr32.exe) when they are spawned by non-system parent processes originating from user-writable paths like AppData, Temp, Roaming, ProgramData, or Desktop. This behavior is commonly associated with malware like Remcos RAT.
This rule detects when a process's command line contains 'ssl' or 'tls' and is observed at least 3 times within an hour on the same computer and by the same account. This could indicate various activities, including legitimate system processes, development activities, or potentially malicious use of SSL/TLS-related tools or scripts. The rule focuses on process creation events (EventID 4688) and analyzes the command line arguments.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
Detects the use of curl.exe to download the Python embeddable zip file directly into the C:\Users\Public directory, indicative of NarwhalRAT staging.
This rule detects unusual parent-child process relationships for 'svchost.exe' and 'explorer.exe'. Specifically, it flags instances where 'svchost.exe' is spawned by a process other than 'services.exe', 'msiexec.exe', or another 'svchost.exe' instance. It also flags 'explorer.exe' being spawned by a process other than 'userinit.exe' or another 'explorer.exe' instance. These relationships can indicate process injection, masquerading, or other forms of malicious activity.
Page 1 of 6