Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
78
4
4
1
Contributors
39
36
4
3
2
Categories
81
14
3
2
1
Platforms
86
1
Products / Services
30
21
4
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
This rule detects the execution of 'wfc.exe', the Workflow Command-line Compiler. This utility is known to be used for Application Whitelisting (AWL) bypasses and is listed in Microsoft's recommended block rules for applications that can bypass Windows Defender Application Control (WDAC). Detection of this executable could indicate an attempt to bypass security controls or execute unauthorized code.
This rule detects the creation of child processes by 'Mftrace.exe', which is a legitimate Windows utility (Trace log generation tool for Media Foundation Tools). Adversaries can abuse 'Mftrace.exe' to execute arbitrary binaries, effectively bypassing application whitelisting or other security controls by proxying execution through a trusted process. The rule specifically looks for any process that has 'mftrace.exe' as its direct parent.
Page 5 of 5