Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
690 detections
Filters
Last updated
All Time
Detection languages
264
186
49
46
40
Contributors
172
97
71
63
41
Categories
370
145
94
90
85
Platforms
589
49
20
14
8
Products / Services
197
179
89
34
27
MITRE Techniques
18,108
15,615
12,573
8,385
6,206
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
Detects process execution originating from the C:\ProgramData\log\ directory. This specific path is utilized as a staging directory by UNC6692 to execute their SNOWGLAZE tunneler and SNOWBASIN bindshell malware payloads.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects the creation of crontab entries executing a payload masquerading as a legitimate Linux dynamic linker (ld-unix.so.2). Masjesu uses this highly specific path and filename combination to disguise its primary persistence mechanism.
Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
System pods, created by controllers such as Deployments or DaemonSets have random suffixes in their names.
Attackers can use this fact and name their backdoor pods as if they were created by these controllers to avoid detection.
Deployment of such a backdoor container e.g. named kube-proxy-bv61v, could be attempted in the kube-system namespace alongside the other administrative containers.
Detects a flashplayer update from an unofficial location
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
Detects the execution of msiexec.exe from an uncommon directory
Detects the creation of a scheduled task using the "-XML" flag with a file without the '.xml' extension. This behavior could be indicative of potential defense evasion attempt during persistence
Detects the creation of scheduled tasks that involve system processes, which may indicate malicious actors masquerading as or abusing these processes to execute payloads or maintain persistence.
Detect suspicious parent processes of well-known Windows processes
Detects a suspicious process that is masquerading as the legitimate "svchost.exe" by naming its binary "svchost.exe" and executing from an uncommon location.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Adversaries often disguise their malicious binaries by naming them after legitimate system processes like "svchost.exe" to evade detection.
Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
This rule detects the execution of AnyDesk from suspicious file paths that are not typically used for legitimate installations of remote access software. It identifies attempts to masquerade AnyDesk by placing it in system-like directories (e.g., Themes, Startup folders, Temp, or AppData subfolders with masquerading names) and also flags elevated executions (SYSTEM account) or service installations from these suspicious locations. The rule specifically excludes legitimate AnyDesk per-user installation paths to reduce false positives.
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
Masqueraded wt.exe - Branch A: Impostor Binary Named wt.exe Detects a process with image name wt.exe whose OriginalFileName does NOT match wt.exe — i.e., a renamed binary masquerading as Windows Terminal.
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
Branch B: Legitimate wt.exe from Non-Standard Path Detects execution of a binary with OriginalFileName=wt.exe running from outside the expected Windows Terminal directories (WindowsApps).
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Detects the creation of files within a specifically misspelled 'Photoes' directory located in ProgramData. This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger to store XOR-encrypted keystroke logs (.trn files).
Detects the creation of an executable named 'msbuild.exe' or its associated '.lock' file inside the Windows user Startup folder by Python or CI/CD processes. This technique was observed in the TeamPCP campaign compromising the Telnyx Python SDK, where a fake MSBuild binary was dropped for stealthy persistence and the lock file was hidden via 'attrib +h'.
Page 26 of 33