Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
78
4
4
1
Contributors
39
36
4
3
2
Categories
81
14
3
2
1
Platforms
86
1
Products / Services
30
21
4
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies the usage of microsoft.workflow.compiler.exe, a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution telemetry. The significance of this activity lies in its uncommon usage, which may indicate malicious intent such as code execution or persistence mechanisms. If confirmed malicious, an attacker could leverage this process to execute arbitrary code, potentially leading to unauthorized access or further compromise of the system.
Detects the execution of legitimate developer utilities msbuild.exe, regasm.exe, and regsvcs.exe in manners consistent with malicious proxy execution. This includes the use of inline tasks in project files, remote network-sourced project files, or specific command-line arguments (such as /codebase or /unregister) that suggest the abuse of these binaries to execute arbitrary code or bypass application control mechanisms, while excluding known legitimate developer-related parent processes and build workflows.
Detects the execution of Microsoft-signed .NET utilities (RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, AspNet_Compiler) when spawned by scripting engines like PowerShell, wscript, or cscript. This behavior is indicative of the Veil#Drop framework using trusted developer utilities as a fallback mechanism to execute secondary payloads or bypass security controls.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Detects WindowsPackageManagerServer.exe launching with the '--manualActivation' flag. This behavior is indicative of the DSCourier COM API abuse technique, which bypasses the standard winget.exe binary to execute malicious Desired State Configuration (DSC) payloads stealthily.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Use of TTDInject.exe
Sigma
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Detects a remote thread creation of Ttdinject.exe used as proxy
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Use of Remote.exe
Sigma
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Use of Wfc.exe
Sigma
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
Page 1 of 5