Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
36
19
7
5
2
Contributors
23
18
4
4
4
Categories
54
37
14
11
6
Platforms
72
3
Products / Services
30
27
16
5
2
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
IDS Protocols
1
1
Detects the trusted .NET host used in Blinder Tunnel to run an attacker-supplied AppDomainManager: a renamed signed Visual Studio hosting binary as RuntimeBroker.exe, or vshost32.exe for the Blackwood tunneling tool. The attacker’s <host>.exe .config names the malicious DLL, which loads before any host code. The genuine RuntimeBroker.exe only runs from System32, and the \Microsoft\RuntimeBrokers\ install folder does not exist on a clean Windows install. The path arm therefore still fires if the actor renames the host. A LaunchContext field separates first execution (MSBuild/devenv .csproj trigger or Inno Setup installer) from Explorer autostart.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects the abuse of built-in Windows binaries 'regsvr32.exe' and 'msbuild.exe' for proxy execution. Specifically, it flags 'regsvr32.exe' loading remote scriptlets via HTTP and 'msbuild.exe' processing project files containing inline tasks, which are common techniques used to execute arbitrary malicious code while bypassing security controls.
Detects the execution of msbuild.exe targeting project files (.csproj, .proj, .xml) located in user-writable directories such as Temp or Downloads, or containing command-line indicators of inline C# task execution (e.g., UsingTask, CodeTaskFactory). This behavior is commonly used for proxy execution and bypassing application allow-listing via LOLBAS.
Detects the execution of legitimate developer utilities msbuild.exe, regasm.exe, and regsvcs.exe in manners consistent with malicious proxy execution. This includes the use of inline tasks in project files, remote network-sourced project files, or specific command-line arguments (such as /codebase or /unregister) that suggest the abuse of these binaries to execute arbitrary code or bypass application control mechanisms, while excluding known legitimate developer-related parent processes and build workflows.
Detects the creation or modification of Windows Registry Run/RunOnce keys that reference msbuild.exe without typical build arguments. This is often used by adversaries to maintain persistence by executing malicious XML-based projects or inline C#/VB code via a trusted system utility.
Detects the execution of MSBuild.exe when spawned by a PowerShell process. This is a common pattern for proxying execution of malicious code, such as the LxBaseRAT, by leveraging MSBuild's inline task capability to execute C# or VB.NET code within a signed Microsoft binary.
Detects the use of MSBuild.exe to compile and execute inline code or tasks. The rule identifies suspicious command-line patterns (such as Task/CodeTaskFactory), execution from non-standard directories (Temp, AppData, Downloads, etc.), and subsequent network or child process activity originating from these MSBuild instances, indicating potential defense evasion or code execution.
Detects the use of MSBuild.exe to compile and execute inline code or tasks. The rule identifies suspicious command-line patterns (such as Task/CodeTaskFactory), execution from non-standard directories (Temp, AppData, Downloads, etc.), and subsequent network or child process activity originating from these MSBuild instances, indicating potential defense evasion or code execution.
Detects the use of MSBuild.exe to compile and execute inline code or tasks. The rule identifies suspicious command-line patterns (such as Task/CodeTaskFactory), execution from non-standard directories (Temp, AppData, Downloads, etc.), and subsequent network or child process activity originating from these MSBuild instances, indicating potential defense evasion or code execution.
Detects the execution of MSBuild.exe with command line arguments pointing to project files (.xml or .csproj) that contain C# inline task structures (e.g., CodeTaskFactory, UsingTask). This technique is commonly used to proxy malicious code execution via a trusted Microsoft binary, bypassing certain application control policies.
Detects the execution of MSBuild.exe initiated by PowerShell involving specific suspicious file names or extensions (.csproj, .xml) or project naming conventions, followed immediately (within 15 minutes) by an external network connection from the MSBuild process to a specific suspicious IP address or non-standard port.
Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.
Detects instances where msbuild.exe is spawned from suspicious parent processes without valid project files and subsequently receives cross-process injection activity (such as CreateRemoteThread or WriteProcessMemory) within a short timeframe. This behavior is indicative of an adversary attempting to use MSBuild to proxy malicious code execution.
Detects instances where msbuild.exe is spawned from suspicious parent processes without valid project files and subsequently receives cross-process injection activity (such as CreateRemoteThread or WriteProcessMemory) within a short timeframe. This behavior is indicative of an adversary attempting to use MSBuild to proxy malicious code execution.
Detects instances where msbuild.exe is spawned from suspicious parent processes without valid project files and subsequently receives cross-process injection activity (such as CreateRemoteThread or WriteProcessMemory) within a short timeframe. This behavior is indicative of an adversary attempting to use MSBuild to proxy malicious code execution.
Detects instances where the MSBuild.exe process is subjected to image replacement or tampering, a behavior often associated with process hollowing or malicious code injection techniques aimed at evading security defenses by masquerading as a legitimate developer utility.
Detects MSBuild.exe establishing a network connection to a specific remote IP address (212.34.141.103) on port 4521. This behavior is indicative of MSBuild being used to proxy execution of malicious code, often associated with downloading and executing second-stage payloads or beaconing to a command-and-control (C2) server.
Detects two distinct methods of living-off-the-land proxy execution: first, MSBuild.exe spawning network connections after executing inline tasks defined in XML project files; second, Regsvr32.exe performing 'Squiblydoo' execution by loading COM scriptlets from remote URLs.
Detects the execution of Microsoft-signed .NET utilities (RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, AspNet_Compiler) when spawned by scripting engines like PowerShell, wscript, or cscript. This behavior is indicative of the Veil#Drop framework using trusted developer utilities as a fallback mechanism to execute secondary payloads or bypass security controls.
Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.
Page 1 of 4