Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects when a password-protected ZIP archive is opened on a Windows system, specifically looking for archives with suspicious filenames commonly used in phishing or social engineering attacks (e.g., 'invoice', 'order', 'payment'). This rule leverages Windows Security Event ID 5379, which indicates a sensitive privilege use, and filters for events related to the Microsoft_Windows_Shell_ZipFolder:filename provider, combined with a list of suspicious keywords in the TargetName field.
Detects suspicious execution of AgentExecutor.exe, a Microsoft Intune component, when it is used to launch PowerShell scripts with potentially bypassed execution policies or to execute a 'powershell.exe' binary from a specified path. This behavior can be indicative of a Living Off The Land Binary (LOLBIN) abuse.
Detects the execution of 'CustomShellHost.exe' where its child process is not 'C:\Windows\explorer.exe'. This behavior can indicate an attempt to use CustomShellHost for proxy execution, potentially bypassing security controls or for defense evasion.
Detects the execution of a renamed Plink binary, which is often used by adversaries for SSH tunneling and data exfiltration. The rule specifically looks for the original filename 'Plink' combined with command-line arguments indicative of port forwarding ('-l forward', '-P', '-R'), while filtering out legitimate executions of 'plink.exe' to reduce false positives.
This rule detects the creation of processes from unusual and potentially suspicious locations on a Windows system. Specifically, it looks for executables being run from the 'RECYCLER' directory, 'SystemVolumeInformation' directory, or various subdirectories within 'C:\Windows\' that are not typically used for executable storage, such as 'Tasks', 'debug', 'fonts', 'help', 'drivers', 'addins', and 'cursors'. Adversaries often use these locations to hide malicious executables and evade detection.
This rule detects potential evasion or obfuscation attempts by identifying command lines that use bogus path traversal. Specifically, it looks for patterns like '\\..\\Windows\\', '\\..\\System32\\', or '\\..\\..\\' within the command line of processes whose image path contains '\\Windows\\'. It also flags command lines containing '.exe\\..\\' which could indicate an attempt to manipulate execution paths. The rule includes filters for known legitimate applications like Google Drive and Citrix that might exhibit similar behavior.
This rule detects suspicious child processes spawned by parent processes that typically should not have any children, or should only have a very limited set of known child processes. The rule specifically looks for child processes of applications like Minesweeper, Winver, Bitsadmin, Csrss, Certutil, Eventvwr, Calc, and Notepad, while filtering out common legitimate child processes for some of these parents (e.g., WerFault.exe, conhost.exe). This behavior can indicate defense evasion or execution of malicious code from an unexpected parent.
Detects the use of 'chcp.com' to switch the system's active code page to a less common or potentially suspicious language, which could be used for defense evasion or to support specific malware functionalities.
Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.
Detects the execution of a process from a directory that is typically not used for legitimate executable files. Adversaries often place their malicious executables in unusual or less-monitored folders to evade detection and blend in with normal system activity. This rule identifies process creations originating from specific suspicious paths like Perflogs, various Users subdirectories, Windows system subdirectories (addins, debug, Fonts, Help, IME, Media, repair, security, Tasks), Recycle Bin, and other less common locations.
This rule detects the creation of processes where the command line contains specific Unicode characters that are visually identical (homoglyphs) to ASCII letter characters. Adversaries use homoglyphs as an obfuscation and masquerading technique to make malicious commands or file names appear legitimate, thereby evading detection and tricking users. The rule specifically targets "perfect" homoglyphs that are indistinguishable from their ASCII counterparts.
Detects the execution of "WerFault.exe" with the "-pr" command-line flag. This specific command-line argument is used to run files stored in the ReflectDebugger registry key, which can be abused by adversaries to masquerade execution flow and achieve persistence or defense evasion by leveraging a legitimate Windows error reporting process.
Detects suspicious use of 'calc.exe' with command line parameters or when executed from a non-standard directory. This behavior is often associated with proof-of-concept exploits, malware, or detection evasion techniques where 'calc.exe' is used to test execution or as a decoy.
Detects the creation of taskmgr.exe process running under the LOCAL_SYSTEM account. This is an unusual and potentially malicious activity, as task manager typically runs under the user's context. This could indicate an attempt to elevate privileges or execute code with SYSTEM privileges.
This rule detects the creation of new processes where the parent process is `taskmgr.exe`. This activity could indicate an attempt to bypass User Account Control (UAC) by leveraging the Windows Task Manager, which is often auto-elevated. The rule filters out common legitimate processes that `taskmgr.exe` might launch, such as `mmc.exe`, `resmon.exe`, and `Taskmgr.exe` itself, to reduce false positives.
This rule detects the execution of 'hxtsr.exe' from an unexpected file path. HxTsr.exe is a legitimate Microsoft Outlook Communications component typically found within a hidden 'WindowsApps' subfolder of 'C:\Program Files'. If 'hxtsr.exe' is executed from any other location, it could indicate malware attempting to masquerade as a legitimate process to evade detection.
Detects suspicious activity involving the Windows Update Agent (wuauclt.exe) where the process is executed without any command-line arguments. This behavior can be indicative of an adversary attempting to masquerade malicious activity by abusing a legitimate system utility.
Detects suspicious use of 'calc.exe' with command line parameters or in a suspicious directory, which is likely caused by some PoC or detection evasion.
Detects uses of a renamed legitimate createdump.exe LOLOBIN utility to dump process memory
Detects suspicious use of XORDump process memory dumping utility
Detects uses of the createdump.exe LOLOBIN utility to dump process memory
Page 40 of 40