Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
14
7
1
1
1
Contributors
6
6
5
3
2
Categories
14
6
5
3
2
Platforms
23
1
Products / Services
14
4
2
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects network connections initiated by 'dfsvc.exe', which is responsible for handling ClickOnce applications, to non-local IP addresses. This activity can be indicative of malicious ClickOnce abuse for trusted code execution, especially when connecting to external or unexpected destinations.
Detects child processes of 'dfsvc.exe' that are launched from the 'AppData\Local\Apps\2.0\' directory, which is indicative of a ClickOnce deployment execution. This rule aims to identify potentially malicious or unexpected ClickOnce application launches.
Detects suspicious execution of rundll32.exe with specific DLLs and functions that are known to be abused for defense evasion and arbitrary code execution, often referred to as Living Off The Land Binaries (LOLBINs). The rule identifies various combinations of DLLs (e.g., url.dll, zipfldr.dll, shell32.dll, mshtml.dll, advpack.dll, ieadvpack.dll, ieframe.dll, shdocvw.dll, syssetup.dll, setupapi.dll, pcwutl.dll, dfshim.dll, scrobj.dll, shimgvw.dll, comsvcs.dll) and their associated functions that can be used to execute scripts, open URLs, or perform other actions in an unexpected manner via rundll32.exe. It includes filters to reduce false positives from legitimate system activities like screensaver or control panel operations.
Page 2 of 2