Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
10
5
1
1
1
Contributors
7
4
3
2
1
Categories
18
7
4
3
2
Platforms
19
Products / Services
5
5
3
2
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
1
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Detects `cmd.exe` spawned by a Discord-enabled backdoor after command decoding rather than by an interactive user or administrative tool. The rule specifically looks for `cmd.exe` executing commands (`/c`) where the parent process is identified as `searchapp.exe`, `echocreep.exe`, `service.exe`, or `update.exe`.
This rule detects the dynamic compilation of C# code using csc.exe followed by immediate access to DPAPI (Data Protection API) vault files. This sequence of events can indicate an adversary compiling and executing code on the fly to decrypt or access sensitive credentials protected by DPAPI.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
Detects the FileZilla executable (filezilla.exe) spawning the C# compiler (csc.exe). This behavior is highly anomalous for a standard FTP client and is a technique used by a trojanized FileZilla variant to perform runtime .NET compilation for its payload.
Detects csc.exe compiling code from Temp or AppData locations, a common pattern for dropper and loader build steps on compromised hosts.
Flags csc.exe invocations compiling from Temp/AppData paths, a practical pivot for GTIG-described malware that compiles C# code obtained at runtime (e.g., via LLM API responses).
This rule detects the execution of 'csc.exe' (C# compiler) when it attempts to create or interact with a file named 'App_Web_spinstall0.aspx'. This specific file name is often associated with web shell activity or malicious code compilation on web servers, particularly in the context of .NET applications. The rule aims to identify potential malicious compilation and execution of web-based backdoors or implants.
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
This query checks for specific processes and domain TLD used in the CVE-2018-4878 flash 0day exploit attack reported by KrCERT.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
CVE: CVE-2018-4878.
Read more here:.
Https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=26998.
Https://helpx.adobe.com/security/products/flash-player/apsa18-01.html.
Http://blog.talosintelligence.com/2018/02/group-123-goes-wild.html.
Http://blog.morphisec.com/flash-exploit-cve-2018-4878-spotted-in-the-wild-massive-malspam-campaign.
Tags: #exploit #CVE-2018-4878 #0day #Korea #Flash.
Detects the execution of the CSharp interactive console (csi.exe) when it is spawned by PowerShell. This activity can be indicative of an adversary leveraging trusted developer utilities for proxy execution, potentially to bypass application controls or execute malicious code.
The following analytic detects the use of the .NET compiler csc.exe for on-the-fly compilation of potentially malicious .NET code. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with csc.exe. This activity is significant because adversaries and malware often use this technique to evade detection by compiling malicious code at runtime. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network.
Detects potential web shell execution originating from the ScreenConnect server process. This rule specifically looks for the ScreenConnect.Service.exe spawning cmd.exe or csc.exe, which could indicate an attacker leveraging a compromised ScreenConnect server to execute arbitrary commands or compile code.
Detects the execution of "csc.exe" by the "w3wp.exe" process, specifically looking for patterns indicative of the MOVEit Transfer CVE-2023-34362 exploitation. This activity is associated with dynamic compilation of malicious DLL files within the .NET framework temporary ASP.NET files directory.
Detects the execution of "csc.exe" to compile .NET code with specific command-line arguments. Attackers often leverage this to compile code on the fly and use it in other stages, potentially for defense evasion or to deliver malicious payloads.
This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
This rule detects the execution of 'csc.exe' (C# compiler) in suspicious file system locations. Attackers often use csc.exe to compile .NET code on the fly, enabling them to bypass traditional defenses and execute malicious code during later stages of an attack. The rule specifically looks for csc.exe execution where the command line arguments indicate compilation in temporary directories, user-specific folders like Public, AppData\Local\Temp, or other common user-writable locations that are not typically used for legitimate software compilation.