Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
10
10
4
1
1
Contributors
12
4
3
2
2
Categories
13
10
7
6
5
Platforms
25
3
1
Products / Services
10
8
5
4
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
3
1
Detects .ps1-named files dropped to disk that are never actually executed by a PowerShell interpreter (powershell.exe / pwsh.exe) within a short window afterward. NeedyMantis's second-stage loader (e.g. encryptbase64.ps1) is raw x64 shellcode, not a real script -- it's read and executed directly by the dropping process, so no genuine PowerShell host process ever references the file by name. Replaces an earlier version of this rule that watched DeviceImageLoadEvents for a .ps1 extension: Windows can only emit an image-load event for a file with a valid PE header loaded via the OS loader, and raw shellcode has no PE header and is never mapped that way, so that approach would not have fired on this malware. Caveat: legitimate deployment tooling that stages a script for delayed or remote execution can also produce this create/execute mismatch; tune the window and add known-good deployment-tool exclusions for your environment.
Detects the execution of search-ms or search protocol URIs that contain a 'crumb' parameter combined with either a 'displayname' parameter or remote path indicators (such as WebDAV/UNC paths). This technique is commonly used by adversaries to redirect Windows Search to a remote, malicious location while masking the source by spoofing the displayed name or path to trick users.
Detects the execution of LNK files masquerading as PDF files through the use of double extensions (e.g., .pdf.lnk). The rule monitors for processes spawned by explorer.exe that contain '.pdf.lnk' in the command line and trigger child processes like PowerShell, CMD, WScript, or MSHTA, which are common indicators of malicious intent.
Detects the creation or presence of Windows Shortcut (LNK) files that use deceptive double extensions (e.g., .pdf.lnk) and specific filenames related to South Korean financial reporting, a technique associated with the threat actor Kimsuky to entice users into executing malicious code.
Detects HTTP and TLS activity associated with the DSCourier malware, specifically identifying attempts to retrieve configuration files disguised as common non-executable extensions (.jpg, .txt) or utilizing non-standard network ports like 8443, which are characteristic of this threat's command and control behavior.
Detects .ps1-named files dropped to disk that are never actually executed by a PowerShell interpreter (powershell.exe / pwsh.exe) within a short window afterward. NeedyMantis's second-stage loader (e.g. encryptbase64.ps1) is raw x64 shellcode, not a real script -- it's read and executed directly by the dropping process, so no genuine PowerShell host process ever references the file by name. Replaces an earlier version of this rule that watched DeviceImageLoadEvents for a .ps1 extension: Windows can only emit an image-load event for a file with a valid PE header loaded via the OS loader, and raw shellcode has no PE header and is never mapped that way, so that approach would not have fired on this malware. Caveat: legitimate deployment tooling that stages a script for delayed or remote execution can also produce this create/execute mismatch; tune the window and add known-good deployment-tool exclusions for your environment.
Detects the execution of a file with a '.Psh' extension named 'UBPPatch.Psh' that is launched by the process 'UBPUpdater.Exe'. This behavior is indicative of a masqueraded script execution where a suspicious binary or script is disguised with an unconventional extension to evade standard detection mechanisms.
Detects the potential creation or execution of malicious JavaScript files that masquerade as PDF or other common documents using double extensions (e.g., .pdf.js). This behavior is often associated with file-based loaders where the operating system masks the true file extension. The rule also triggers when these files are explicitly launched via Windows Script Host (wscript.exe or cscript.exe).
Detects potential misuse of the WinGet configuration feature, where remote Desired State Configuration (DSC) YAML files are retrieved using masqueraded file extensions (e.g., .jpg or .txt) or suspicious outbound connections on port 8443, which may indicate an adversary attempting to hide malicious configurations or bypass network filtering.
Detects the execution of LNK files that use a double extension (e.g., .pdf.lnk) to masquerade as PDF documents. This behavior is indicative of spear-phishing campaigns where malicious shortcuts are delivered via ZIP archives to execute hidden PowerShell commands for secondary stage downloader or persistence mechanisms.
Detects the Windows Script Host (wscript.exe or cscript.exe) executing files with suspicious double extensions, specifically those mimicking PDF documents (e.g., .pdf.js) or utilizing the .jse extension. This pattern is commonly associated with fileless initial execution lures, often seen in ClickFix-style or VEIL#DROP campaigns designed to trick users into executing malicious scripts.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
Double extension masquerading is a defense-evasion technique (cataloged under MITRE ATT&CK T1036.007) where a malicious executable file is disguised with a safe-sounding first extension, such as .pdf.exe or .jpg.scr , etc, to trick users into opening it.
This rule is used to detect suspicious double Extension Masquerading
This rule is used to detect suspicious double Extension Masquerading
Detects the creation of specific image files (e.g., .png, .bmp) at the root of the system drive (C:\). This behavior is associated with certain ransomware strains (such as NoEscape) that stage files with misleading extensions in unusual locations to evade detection.
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Detects the execution of .bat or .cmd scripts disguised as VPN installer components utilizing curl or wget to pull down malware.
Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
Detects the execution of mshta.exe where the command line arguments reference a file with a .pdf extension. This technique is used by Gamaredon (GammaPhish) to execute disguised HTA payloads after WinRAR exploitation.
Page 1 of 2