Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Identifies 'forfiles.exe' being executed with a combination of multiple command-line switches ('/c', '/p', '/m' or their hyphenated equivalents). This pattern can indicate automated scripting or malicious Living-off-the-Land activity, where 'forfiles.exe' is used to execute commands on multiple files or in specific directories.
This rule detects instances where the SQL Server process (sqlservr.exe) spawns common command-line interpreters or administrative utilities that are frequently abused by attackers for post-exploitation activities, such as command execution, enumeration, or evasion. This behavior often indicates an attempt to leverage SQL Server's capabilities to execute operating system commands, such as via the xp_cmdshell procedure.
Detects Microsoft SQL Server (sqlservr.exe or mssql.exe) spawning common administrative or potentially malicious utilities (e.g., cmd.exe, powershell.exe, curl.exe, etc.). This behavior is often indicative of unauthorized code execution or lateral movement originating from the database engine, which should not typically initiate these processes.
Detects instances where DllHost.exe creates executable or script files within sensitive Windows directories (e.g., Public, Temp, ProgramData). This behavior is often indicative of WSL2 filesystem proxying, where a Linux process initiates a file write to the Windows filesystem via /mnt/c/, causing the DllHost.exe process to proxy the write operation and obscuring the original Linux process origin.
Detects instances where the Windows Subsystem for Linux (wsl.exe) process is used to launch standard Windows command-line interpreters (cmd.exe, powershell.exe, or pwsh.exe). This pattern is often used as a technique to facilitate cross-environment execution or to evade certain security controls by running Windows binaries from within the WSL context.
This rule detects various activities related to the Windows Subsystem for Linux (WSL), specifically focusing on: 1) Executing network tools like curl or wget via wsl.exe, 2) The creation of executable or script files in suspicious directories (User\Public, ProgramData, Windows\Temp) by DllHost.exe, and 3) The execution of wsl.exe or wslhost.exe. These behaviors are often associated with adversaries using WSL to bypass security controls, stage payloads, or facilitate command-and-control communication.
Detects instances where the Windows Subsystem for Linux (WSL) process spawns a Windows command shell (cmd.exe) or PowerShell (powershell.exe). This pattern is often used to execute native Windows commands from within a Linux environment, potentially as a technique for stealthy command execution or to bypass traditional Windows-based monitoring and security controls.
Detects potential payload staging activities within a WSL2 environment where a process writes an executable or script to the Windows filesystem using the DllHost.exe (COM Surrogate) proxy. This rule uses process activity on the host to infer the presence of a WSL2 environment (wsl.exe or vmmem) and analyzes the absence of Windows-native network events, which is a characteristic pattern of WSL2-based network activity being hidden from Windows host telemetry.
Detects instances where DllHost.exe (COM Surrogate) creates executable or script files in high-risk, user-writable directories. This activity is indicative of potential exploitation of the Windows Subsystem for Linux (WSL2) filesystem proxy, where a Linux process running within WSL2 writes files to the Windows host filesystem (/mnt/c/), resulting in the file creation event being attributed to the DllHost.exe COM surrogate on the Windows side.
Detects instances where ImageMagick (magick.exe) or legacy conversion tools (convert.exe) spawn Ghostscript executables (gswin64c.exe, gswin32c.exe) from non-standard or user-writable directories (e.g., Temp, AppData, Public). This pattern is indicative of a delegate path hijacking attack, where an adversary attempts to execute arbitrary code by forcing a vulnerable application to load a malicious Ghostscript binary instead of the legitimate, installed version.
Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe. This LOLBIN evasion technique is actively used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
This rule detects known Living-off-the-Land Binaries (LOLBins) initiating outbound network connections to specific non-standard or commonly suspicious ports (8080, 8443, 4444, 1337, 1234). The rule excludes private/loopback network traffic and common Microsoft-related domains to reduce noise. Such behavior is often indicative of malicious activity, including C2 communication or unauthorized file downloads via trusted system processes.
This rule detects known Living-off-the-Land Binaries (LOLBins) initiating outbound network connections to specific non-standard or commonly suspicious ports (8080, 8443, 4444, 1337, 1234). The rule excludes private/loopback network traffic and common Microsoft-related domains to reduce noise. Such behavior is often indicative of malicious activity, including C2 communication or unauthorized file downloads via trusted system processes.
This rule detects the execution of potentially malicious processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe) initiated by mmc.exe or explorer.exe, excluding known legitimate Microsoft Management Console (MMC) flags and common management snap-ins. This pattern is indicative of potential proxy execution or misuse of system administration utilities to run unauthorized code.
Detects instances where the Windows Subsystem for Linux (WSL) process (wsl.exe) is used to execute native Windows command-line interpreters or utilities. This behavior is often associated with attackers using WSL as a living-off-the-land technique to evade security monitoring, run obfuscated payloads, or bypass execution restrictions by crossing the Linux/Windows boundary.
This rule detects suspicious activity involving the BITSAdmin (bitsadmin.exe) utility, which is a known LOLBin (Living Off the Land Binary). It monitors for the creation of BITS jobs using suspicious flags (e.g., /transfer, /setnotifycmdline) potentially indicating external file downloads, as well as the execution of known command interpreters or utilities spawned as child processes by BITSAdmin, which is a common post-exploitation technique for persistence or secondary payload execution.
Detects Microsoft Office applications (Word, Excel, PowerPoint) and WordPad spawning command-line interpreters (mshta, wscript, cscript, cmd, powershell, pwsh). This behavior is often associated with macro-based malware or malicious document attachments attempting to execute scripts or shell commands to facilitate further infection stages.
Detects the creation of scheduled tasks using schtasks.exe where the task action executes a scripting engine or living-off-the-land binary (LOLBin). This behavior is often indicative of adversaries attempting to establish persistence or execute code using native system tools to evade detection.
Detects unauthorized execution of node.exe by the Flowise process, where a case-insensitive environment variable (node_options) is used to bypass Flowise's security block list. This enables attackers to leverage the --require flag to preload malicious JavaScript code. The detection also monitors for the presence of a 'flowise_marker.txt' file as a secondary indicator.
Page 6 of 17