Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
This rule detects the execution of ZipExec, a Proof-of-Concept (POC) tool designed to wrap binary-based tools into a password-protected zip file. It specifically looks for command-line arguments indicative of ZipExec's 'run' functionality (extracting and executing a zip file with a password) or 'delete' functionality (deleting the extracted files). The detection relies on specific strings like '/generic:Microsoft_Windows_Shell_ZipFolder:filename=', '.zip', '/pass:', '/user:' for 'run' operations, and '/delete', 'Microsoft_Windows_Shell_ZipFolder:filename=', '.zip' for 'delete' operations.
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
This rule detects the execution of `Cmdl32.exe` with the `/vpn` and `/lan` flags. Attackers can abuse this legitimate Windows utility to download arbitrary files by providing a malicious configuration file. The rule advises inspecting the location and content of the file passed as an argument to determine if it is suspicious.
Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Detects suspicious Splwow64.exe process execution without any command line parameters. This behavior can be indicative of indirect command execution or defense evasion techniques where adversaries might abuse legitimate Windows processes to execute malicious code without directly invoking a command-line interpreter.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
Detects the abuse of custom file open handlers by modifying registry keys to execute PowerShell commands. This technique can be used for persistence or defense evasion by adversaries to run arbitrary code when a specific file type is opened.
Detects a Windows service binary being created or executed from suspicious directories that are commonly used by adversaries for defense evasion or persistence. The rule specifically looks for processes whose parent is 'services.exe' or 'svchost.exe' and whose image path contains known suspicious user-writable or system-specific directories.
Page 17 of 17