Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
40
38
4
2
2
Contributors
23
15
14
9
6
Categories
26
18
14
12
8
Platforms
62
26
4
4
4
Products / Services
27
16
12
8
4
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
IDS Classtypes
4
IDS Protocols
2
2
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
This rule detects the creation of Microsoft Office files (Word documents, Excel spreadsheets) within the default startup folders for Microsoft Word and Excel. This technique can be used by adversaries to establish persistence, as these files will automatically execute or load when the respective Office application is launched. The rule specifically looks for file creations in paths containing '\Microsoft\Word\STARTUP' or '\Microsoft\Excel\XLSTART', and also considers paths containing both '\Office' and '\Program Files' along with '\STARTUP' or '\XLSTART'. It filters out legitimate creations by the Office applications themselves (WINWORD.exe, EXCEL.exe) to reduce false positives.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects creation of Microsoft Office files inside of one of the default startup folders in order to achieve persistence.
Hides the file extension through modification of the registry
Page 5 of 5