Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the execution of a renamed "NirCmd.exe" binary based on its original filename metadata. This rule specifically looks for instances where the 'OriginalFileName' field in the process creation event is 'NirCmd.exe', but the actual executed image path does not end with 'nircmd.exe' or 'nircmdc.exe'. This indicates an attempt to evade detection by renaming the legitimate NirCmd utility.
This rule detects the execution of the PingCastle utility, a legitimate Active Directory security assessment tool, when its executable name has been changed. Adversaries often rename legitimate tools to evade detection. The detection logic relies on identifying specific original file names within the PE metadata (OriginalFileName) and/or recognizing characteristic command-line arguments used by PingCastle, such as those related to scanner functions or health checks. The rule specifically filters out executions where the image path matches the original PingCastle executable names, focusing on instances where the binary has been renamed.
This rule detects the creation of a 'conhost.exe' process running with high integrity (elevated privileges) and using the '-ForceV1' and '0xffffffff' command-line options. This combination can be indicative of an attempt to bypass security controls or execute commands indirectly, as 'ForceV1' requests information directly from the kernel space and 'conhost' connects to the console application. This behavior has been observed in campaigns like Conti ransomware.
Detects the execution of PAExec, a legitimate remote administration tool, when its executable name has been changed from the default 'PAExec.exe'. Adversaries often rename legitimate tools like PAExec to evade detection by security products that might flag the original executable name. The rule identifies PAExec based on its internal metadata (Description, OriginalFileName, Product) or specific IMPHASH values, and then filters out instances where the executable retains its original name or is executed from a known PAExec-specific directory created by the tool itself (e.g., C:\Windows\PAExec-XXXXX-ComputerName). This helps to focus on suspicious renamed executions.
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles. The rule specifically looks for child processes with suspicious image names (e.g., calc.exe, regsvr32.exe, rundll32.exe, cscript.exe, wscript.exe), PowerShell or command prompt processes executing suspicious commands (e.g., Invoke-Expressions, IEX, Invoke-Command, DownloadString, rundll32, regsvr32, wscript, cscript), or child processes launched from suspicious paths (e.g., C:\Users\Public\, C:\Windows\Temp\, C:\Temp\).
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
Detects the execution of a Microsoft Office application (Excel, PowerPoint, Word) that attempts to open a document located in a trusted Microsoft Office location. Attackers often leverage this technique to bypass macro security warnings and execute malicious code, as documents in trusted locations may not trigger security prompts. The rule specifically looks for parent processes like explorer.exe or dopus.exe launching these Office applications with command-line arguments pointing to documents within known trusted paths such as AppData\Roaming\Microsoft\Templates or Microsoft Office\root\Templates. It filters out common template file extensions (.dotx, .xltx, .potx) to reduce false positives.
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Detects the execution of Windows binaries from within a Windows Subsystem for Linux (WSL) instance. This technique can be used by adversaries to masquerade parent-child process relationships, making it harder to detect malicious activity.
Detects uncommon or suspicious child processes spawning from a Windows Subsystem for Linux (WSL) process. This behavior can indicate an attempt to evade parent/child relationship detections, or persistence attempts using cron within WSL. The rule specifically looks for common Windows LOLBINs (Living Off the Land Binaries) or processes launched from suspicious temporary or user-controlled directories, originating from wsl.exe or wslhost.exe.
Detects the execution of 'find.exe' or 'findstr.exe' where the command line arguments include a '.lnk' file. This behavior has been observed in attacks, such as the HHS redirect attack, where adversaries use these legitimate Windows utilities to indirectly execute malicious shortcut files.
Detects suspicious child processes spawned by "BgInfo.exe" or "BgInfo64.exe". This behavior can indicate an attempt to abuse BgInfo, a legitimate Microsoft utility, for proxy execution of other binaries or scripts, often to bypass application whitelisting or other security controls. The rule specifically looks for common command-line interpreters (cmd.exe, powershell.exe, cscript.exe, wscript.exe), other executables (calc.exe, notepad.exe, mshta.exe), or executables launched from suspicious user-writable directories (AppData, Users\Public, Temp, PerfLogs).
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects the execution of Microsoft's bash launcher (bash.exe) with the "-c" flag. This technique can be used by adversaries to bypass defenses and execute Linux or Windows-based binaries indirectly via bash, leveraging the Windows Subsystem for Linux (WSL) environment.
This rule detects the potential for arbitrary file downloads initiated by Microsoft Office applications (Excel, PowerPoint, Word). It specifically looks for instances where these applications are executed and their command line arguments contain HTTP or HTTPS URLs, indicating an attempt to download content from the internet. This behavior can be abused by adversaries to fetch malicious payloads.
This rule detects the loading of 'sdiageng.dll' by 'msdt.exe'. This specific combination is known to be exploited by vulnerabilities such as CVE-2022-30190 (Follina) and DogWalk, which leverage msdt.exe for arbitrary code execution by loading a diagnostic library.
Detects uncommon child processes spawned by 'BgInfo.exe' or 'BgInfo64.exe'. This behavior can indicate an adversary abusing BgInfo, a legitimate Microsoft utility, to proxy execution of malicious code, potentially via external VBScript, as part of defense evasion or execution tactics.
Detects the execution of PowerShell scripts via 'Runscripthelper.exe' when the command line contains 'surfacecheck'. This behavior is suspicious as 'Runscripthelper.exe' is a legitimate Windows binary that can be abused for indirect command execution, often as part of Living Off The Land Binaries and Scripts (LOLBAS) techniques.
This rule detects the execution of PowerShell cmdlets related to 'TroubleshootingPack' with specific arguments, which could indicate an attempt to leverage vulnerabilities like CVE-2022-30190 (Follina) or similar techniques used by the 'msdt' LOLBIN (Living Off the Land Binaries). The detection specifically looks for the combination of 'Invoke-TroubleshootingPack', the path 'C:\Windows\Diagnostics\System\PCW', '-AnswerFile', and '-Unattended' within the PowerShell script block text. This pattern is indicative of an attempt to execute diagnostic packages in an unattended manner, often exploited for arbitrary code execution.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
This rule detects the execution of the Microsoft bash launcher (bash.exe) without any command-line flags. This behavior can be indicative of an adversary attempting to bypass security defenses by executing Linux or Windows-based binaries indirectly through bash, potentially leveraging it as a living-off-the-land binary (LOLBAS). The rule specifically looks for bash.exe being run without common flags like '-' or an empty command line, suggesting an attempt to execute a script or command without directly specifying it as an argument.
Page 16 of 17