Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
31
14
4
2
2
Contributors
11
11
10
6
5
Categories
46
17
11
9
7
Platforms
56
1
Products / Services
24
15
11
5
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies a suspicious `explorer.exe` process with the `/root` command-line parameter. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process and command-line data. The presence of `/root` in `explorer.exe` is significant as it may indicate parent process spoofing, a technique used by malware to evade detection. If confirmed malicious, this activity could allow an attacker to operate undetected, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects the 2CLoader malware dropping and executing a payload from user-writable directories such as Temp or Downloads. The rule identifies suspicious process lineage by checking for a parent-process spoofing scenario where the reported parent is explorer.exe, but the actual initiator is a different process, excluding common legitimate installer filenames to reduce noise.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects instances where powershell.exe appears to be launched by explorer.exe via parent process ID (PPID) spoofing. The rule identifies processes where the reported parent explorer.exe was created at or after the child powershell.exe, or within a suspiciously short timeframe, indicating that the parent PID association is likely fraudulent rather than a genuine explorer-initiated shell.
Detects instances where PowerShell is executed with an explorer.exe parent process, but the actual creating process differs from explorer.exe. This behavior is indicative of parent PID (PPID) spoofing, a technique often used to evade detection or masquerade the execution source by abusing the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS flag in the Windows API.
Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.
This rule detects the potential use of parent process spoofing (PPID spoofing) where a PowerShell process is spawned with 'explorer.exe' as its parent. This technique, often executed via the 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' attribute in a 'CreateProcessW' call, is used by adversaries to mask the true origin of the PowerShell process and evade behavioral detection.
Detects instances where PowerShell is launched with explorer.exe as its parent process, but where the child process's metadata (creation time, logon ID, or account SID) does not align with the recorded explorer.exe process. This discrepancy is a strong indicator of Parent Process ID (PPID) spoofing, a technique often used to evade security monitoring.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Page 1 of 3