Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
133
63
23
18
6
Contributors
63
43
30
19
18
Categories
177
52
37
28
18
Platforms
247
11
6
1
Products / Services
71
51
33
24
7
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the creation of processes where the command line contains specific Unicode characters that are visually identical (homoglyphs) to ASCII letter characters. Adversaries use homoglyphs as an obfuscation and masquerading technique to make malicious commands or file names appear legitimate, thereby evading detection and tricking users. The rule specifically targets "perfect" homoglyphs that are indistinguishable from their ASCII counterparts.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
This rule detects the execution of the Microsoft Support Diagnostic Tool (msdt.exe) when its executable file has been renamed. Adversaries often rename legitimate system utilities to evade detection mechanisms that might be looking for the original executable name. By checking for the original filename 'msdt.exe' in the process metadata while ensuring the image path does not end with '\msdt.exe', the rule identifies instances where the utility is run under a different name.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Page 13 of 13