Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
133
63
23
18
6
Contributors
63
43
30
19
18
Categories
177
52
37
28
18
Platforms
247
11
6
1
Products / Services
71
51
33
24
7
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
Detects the execution of a binary that has been renamed from its original name, often used by attackers or malware for defense evasion. This rule leverages the Sysmon 'OriginalFileName' datapoint to identify instances where common Windows utilities or attacker tools are executed under a different filename.
Detects the execution of 'rundll32.exe' where the loaded DLL does not have a '.dll' extension, often observed in Qakbot activity. The rule specifically looks for 'rundll32.exe' being spawned by common scripting or command-line interpreters and for the command line to contain paths frequently used by Qakbot for its payloads.
Detects the execution of a renamed SysInternals tool, specifically 'ps.exe', with command-line arguments '-accepteula' and '-s cmd /c netstat'. This specific combination has been observed in attacks attributed to the Dragonfly APT group and is documented in the US-CERT TA17-293A alert.
Detects the use of bitsadmin.exe to download files with suspicious extensions. This technique is often used by adversaries for defense evasion and persistence by leveraging a legitimate Windows utility to transfer malicious payloads.
Detects the use of the built-in Windows utility bitsadmin.exe to download files. This utility is often abused by adversaries for ingress tool transfer, as it can bypass certain network restrictions and is a living-off-the-land binary (LOLBIN). The rule specifically looks for the execution of bitsadmin.exe with command-line arguments indicative of file transfer operations, such as '/transfer', '/create', '/addfile', and the presence of 'http' to signify a URL download.
This rule detects attempts to masquerade as the Linux 'crond' process by copying '/bin/sh' to a file ending with '/crond' and executing it. This technique is often used by adversaries to evade detection by making malicious processes appear as legitimate system services.
This rule detects the execution of Remote Utilities RAT (RURAT) executables (`rutserv.exe` or `rfusclient.exe`) or any process with 'Remote Utilities' in its product name, when they are launched from an unusual location, specifically outside of the standard 'C:\Program Files\Remote Utilities' or 'C:\Program Files (x86)\Remote Utilities' directories. This behavior can indicate an attempt to evade detection or establish persistence by placing the RAT in a non-standard path.
Detects the use of the rcedit tool to modify Portable Executable (PE) metadata properties such as OriginalFileName, CompanyName, FileDescription, ProductName, ProductVersion, and LegalCopyright. This activity could indicate an attempt to conceal the true nature of an executable, potentially for defense evasion by masquerading as a legitimate utility or by removing indicators from malicious tools.
Detects "GoogleUpdate.exe" spawning a new instance of itself in an uncommon location, a technique used by the Goofy Guineapig backdoor to evade detection. The rule specifically looks for instances where both the parent and child process images are named 'GoogleUpdate.exe', but the child process is not located in standard Google installation or update paths.
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.
This rule detects the execution of the AutoHotkey.exe binary when it has been renamed. It identifies this by looking for specific PE metadata fields such as 'Product' or 'Description' containing 'AutoHotkey', or 'OriginalFileName' being 'AutoHotkey.exe' or 'AutoHotkey.rc', while simultaneously filtering out executions where the image path ends with or contains the legitimate 'AutoHotkey.exe' or its variants.
Detects the creation of suspicious binary files (DLL, EXE, SYS) within the `C:\Windows\System32\spool\drivers\color\` directory. This activity has been observed in attacks by threat actors, such as those described in the referenced Microsoft blog, where it's used for defense evasion or persistence by dropping malicious payloads in a trusted system directory.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects the execution of a process where the original description is 'Java Update Scheduler' or 'Java(TM) Update Scheduler', but the executable file name is not 'jusched.exe'. This behavior is indicative of an adversary renaming a legitimate utility to evade detection, a technique known to be used by groups like Cobalt Group.
Detects the execution of Rundll32.exe where the command line contains file extensions commonly associated with image files. This behavior is suspicious as Rundll32.exe is typically used to execute DLL functions, and its use with image file extensions can indicate an attempt to masquerade malicious DLLs or scripts as benign image files to evade detection.
Detects a suspicious copy operation that tries to copy a known LOLBIN from system (System32, SysWOW64, WinSxS) directories to another on disk in order to bypass detections based on locations. This technique is often used by adversaries to evade security controls that monitor execution from standard system paths.
Detects when 'DllRegisterServer' is called in the command line of a process that is not 'rundll32.exe'. This behavior is indicative of an adversary renaming the 'rundll32' utility to evade detection, while still leveraging its functionality to execute DLLs.
Detects the use of bitsadmin.exe to download a file from a direct IP address. This technique is often used by adversaries for ingress tool transfer or to establish persistence by downloading malicious payloads directly from an IP address, bypassing typical domain-based filtering or logging.
This rule detects the execution of Microsoft Office applications (Excel, Access, Publisher, OneNote, Outlook, PowerPoint, Word) when their executable files have been renamed. It identifies processes where the original file name or description indicates an Office application, but the executed image path does not match the standard, legitimate executable name for that application. This technique is often used by adversaries for defense evasion to bypass security controls that monitor known legitimate application names.
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.
Page 12 of 13