Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
78
4
4
1
Contributors
39
36
4
3
2
Categories
81
14
3
2
1
Platforms
86
1
Products / Services
30
21
4
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Detects the execution of CSharp interactive console by PowerShell
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Code injection in msbuild.exe by .scr file
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Detects the execution node.exe which is shipped with multiple software such as VMware, Adobe...etc. In order to execute arbitrary code. For example to establish reverse shell as seen in Log4j attacks...etc
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Use of Wfc.exe
Sigma
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects child processes of the "Trace log generation tool for Media Foundation Tools" (Mftrace.exe) which can abused to execute arbitrary binaries.
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Use of Remote.exe
Sigma
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Detects the execution of the "jsc.exe" (JScript Compiler).
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
Attacker might abuse this in order to compile JScript files on the fly and bypassing application whitelisting.
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Page 2 of 5