Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
141 detections
Filters
Last updated
All Time
Detection languages
53
43
14
13
8
Contributors
34
28
16
10
8
Categories
102
100
43
23
13
Platforms
141
4
1
1
Products / Services
46
40
29
10
10
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
Detects suspicious processes, including various shells and utilities, spawned by the WinRM host process (wsmprovhost.exe). This activity can indicate an adversary using WinRM for remote execution, potentially for initial access, persistence, or privilege escalation.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
Detects the execution of Living Off The Land Binaries (LOLBINs) from an unusual or abnormal drive, such as a mounted ISO. This behavior can indicate an attempt by an adversary to evade detection by executing legitimate system tools from non-standard locations, often associated with initial access or defense evasion techniques.
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
This rule detects suspicious child processes spawned by parent processes that typically should not have any children, or should only have a very limited set of known child processes. The rule specifically looks for child processes of applications like Minesweeper, Winver, Bitsadmin, Csrss, Certutil, Eventvwr, Calc, and Notepad, while filtering out common legitimate child processes for some of these parents (e.g., WerFault.exe, conhost.exe). This behavior can indicate defense evasion or execution of malicious code from an unexpected parent.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') in conjunction with an 'http' string in the command line, indicating an attempt to download files from a remote HTTP source. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads.
This rule detects potential NTLM coercion attempts using the built-in Windows utility 'certutil.exe'. Specifically, it looks for command-line executions of 'certutil.exe' that include both the '-syncwithWU' flag and a UNC path (indicated by '\\'). This combination is known to be abused by attackers to force a Windows machine to authenticate to an attacker-controlled server, thereby coercing it to send its NTLM hash.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Detects Windows command lines that miss a space before or after the /c or /k flag when running a command using cmd.exe. This could indicate an attempt at command obfuscation or a typo. The rule specifically looks for patterns like 'cmd.exe/c', '\cmd/c', '"cmd/c', and similar for /k and /r, as well as specific commands like '/cwhoami', '/cpowershell', etc., where the space is missing. It filters out common false positives related to VS Code and specific command line endings.
Detects a network connection initiated by the certutil.exe utility. Attackers can abuse this utility to download malware or additional payloads.
Detects the execution of certutil.exe with specific flags ('urlcache' or 'verifyctl') to download files from direct IP addresses. This technique is often used by adversaries for ingress tool transfer or to retrieve malicious payloads, bypassing traditional web proxies or security controls that might monitor domain-based traffic.
Page 7 of 7