Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects a process tree where Code.exe (VS Code) spawns node.exe as an intermediary process, which in turn spawns calc.exe. This matches the child_process.exec execution pattern observed when a malicious VS Code extension dependency decodes and runs an arbitrary command, demonstrating that any payload (not just calc.exe) can be executed via this chain.
Detects creation of scheduled tasks followed by execution of pcalua.exe on the same endpoint. This combination was observed by Huntress during RedCurl intrusions and is uncommon in legitimate enterprise activity.
Detects the Windows Help executable (hh.exe) launching the Windows script interpreters (wscript.exe or cscript.exe) with suspicious command-line flags. This pattern is commonly used in fileless malware delivery, script-based obfuscation, and bypass of security controls using built-in Windows utilities.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
Detects evidence of arbitrary command execution originating from OpenVPN Connect, potentially via an echoed script payload that executes commands upon disconnect, bypassing security controls. The rule identifies suspicious child processes spawned by OpenVPNConnect.exe and detects the creation of a known proof-of-concept marker file.
Detects instances where ConfigurationRemotingServer.exe spawns known living-off-the-land binaries (LOLBINs) or executes binaries from suspicious paths. This behavior is indicative of abuse of the WinGet DSC WindowsProcess resource block to execute arbitrary commands.
Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.
Detects the execution of suspicious Windows native processes spawned directly by wsl.exe. Attackers leverage WSL2 interop functionality to execute Windows-native binaries from within a Linux environment, using the wsl.exe process tree to obscure their activities and stage payloads.
Detects instances where the Windows Subsystem for Linux (WSL) processes (wsl.exe or wslhost.exe) are spawned by suspicious parent processes, which may indicate an attempt to use WSL for payload execution or persistence on hosts where its usage is restricted or not authorized.
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
Detects instances where common browser processes (e.g., Chrome, Edge, Firefox) spawn command-line tools or scripting interpreters such as PowerShell, cmd, mshta, or rundll32. This pattern is characteristic of 'ClickFix' social engineering attacks where users are tricked into executing malicious commands under the guise of troubleshooting or CAPTCHA resolution.
Detects the execution of known Living-off-the-Land (LotL) binaries (e.g., powershell.exe, certutil.exe, mshta.exe) where the parent or initiating process is the Windows Subsystem for Linux (WSL2) wsl.exe binary. This pattern indicates potential abuse of WSL2 interop features to execute Windows-native binaries from a Linux environment, often used to bypass traditional host-based monitoring or security controls.
Detects the execution of short-named executable binaries from common staging directories (Users\Public, Windows\Temp, ProgramData) where the parent process is DllHost.exe, explorer.exe, or cmd.exe. This pattern is indicative of WSL2 being used to stage and execute payloads, where DllHost.exe is leveraged to proxy file operations from the WSL2 environment to the Windows host, potentially bypassing certain security controls.
Detects the 'Operation Highland' technique where an attacker-controlled binary named 'uptime' is executed by the 'fcgiwrap' process. This configuration acts as a FastCGI bridge, which subsequently spawns 'ssh' to establish unauthorized network connections into isolated network segments based on parameters received via HTTP POST requests.
Detects the Windows Subsystem for Linux (WSL) process, wsl.exe, spawning common Windows binaries that are frequently used for command and script execution, potentially as a technique for indirect command execution or evasion.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
Detects instances where the 'forfiles.exe' utility is executed by 'explorer.exe'. This is an atypical parent-child process relationship that may indicate an attempt to use 'forfiles' for indirect command execution or to facilitate malicious actions while avoiding direct command prompt usage.
Page 5 of 17