Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects the use of "DumpMinitool.exe" a tool that allows the dump of process memory via the use of the "MiniDumpWriteDump"
Detects suspicious ways to use the "DumpMinitool.exe" binary
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries,
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost"
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory.
HxTsr.exe is a Microsoft compressed executable file called Microsoft Outlook Communications.
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
HxTsr.exe is part of Outlook apps, because it resides in a hidden "WindowsApps" subfolder of "C:\Program Files".
Any instances of hxtsr.exe not in this folder may be malware camouflaging itself as HxTsr.exe
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
This binary can be abused for DLL injection, arbitrary command and process execution.
Detects the execution of a renamed version of the Plink binary
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
This is used as an obfuscation and masquerading techniques. Only "perfect" homoglyphs are included; these are characters that
are indistinguishable from ASCII characters and thus may make excellent candidates for homoglyph attack characters.
Detects suspicious parent processes that should not have any children or should only have a single possible child program
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output get renamed, or a dump file is moved or copied to a different name
Detects the creation of taskmgr.exe process in context of LOCAL_SYSTEM
Detects execution of "WerFault.exe" with the "-pr" commandline flag that is used to run files stored in the ReflectDebugger key which could be used to store the path to the malware in order to masquerade the execution flow
Detects suspicious Windows Update Agent activity in which a wuauclt.exe process command line doesn't contain any command line flags
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Page 30 of 40