Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe. This LOLBIN evasion technique is actively used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects instances where critical Windows system processes (svchost.exe or lsass.exe) spawn suspicious child processes. This pattern often indicates process injection or unauthorized activity where an adversary uses these legitimate, high-privileged processes as a parent to execute malicious payloads, bypass security controls, or maintain persistence.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects instances where ConfigurationRemotingServer.exe spawns known living-off-the-land binaries (LOLBINs) or executes binaries from suspicious paths. This behavior is indicative of abuse of the WinGet DSC WindowsProcess resource block to execute arbitrary commands.
Detects the execution of ConfigurationRemotingServer.exe by WindowsPackageManagerServer.exe when the parent process is not winget.exe. This pattern is indicative of unauthorized attempts to invoke the Windows Package Manager DSC (Desired State Configuration) engine directly, bypassing standard tooling and potentially indicating an attempt to leverage COM interface abuse for code execution.
Detects the invocation of Windows command-line utilities (such as cmd.exe or powershell.exe) by the Windows Subsystem for Linux (WSL) process wsl.exe. This behavior indicates that a Linux-side process or user is leveraging the WSL interoperability layer to execute commands directly within the Windows host environment, which can be a technique used for defense evasion or moving between Linux and Windows contexts.
Detects suspicious file drops by DllHost.exe into staging directories (e.g., C:\Users\Public\ or C:\ProgramData\) occurring shortly after the execution of wsl.exe, where the DllHost process itself exhibits no network activity in the host telemetry. This behavior is indicative of an attacker leveraging the Windows Subsystem for Linux (WSL2) to download payloads or tools that bypass standard Windows network monitoring, leaving behind an artifact dropped by a COM surrogate.
Detects the execution of wscript.exe with the /elevated argument, where the process was spawned by another wscript.exe instance. This behavior is indicative of potential malicious script execution attempting to bypass normal user execution constraints or using techniques to maintain elevation, often associated with living-off-the-land binaries.
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
Detects a Go-based backdoor associated with 'The Gentlemen' ransomware group executing commands via cmd.exe. The rule monitors for a specific pattern of WMI UUID queries alongside command-line execution of system discovery tools (whoami, net group, dir) via cmd.exe /c, which is indicative of remote command execution over a Yamux C2 channel.
Detects unexpected child process execution spawned by the Lunar Client Electron main process. This rule is designed to identify potential exploitation attempts, such as the lunar-modrinth-chain exploit, where malicious files (e.g., .mrpack entries) could lead to arbitrary code execution via shell.openExternal calls.
Detects instances of PowerShell being launched by common scripting host binaries (mshta.exe, wscript.exe, cscript.exe) with command-line arguments indicative of malicious activity, such as encoded commands, hidden windows, and remote code download patterns (e.g., iex, Invoke-RestMethod). The rule further checks for indicators related to the Lightlife C2 infrastructure.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
Detects pcalua.exe used as a LOLBin to proxy the execution of mshta.exe, which is a known technique for adversaries to execute malicious code (Potemkin/ClickFix). The rule specifically looks for pcalua.exe executing with command-line arguments that include both '-a' and 'mshta.exe'.
Detects instances where the Windows COM surrogate (DllHost.exe) writes executable files or scripts to user-writable/temp directories. This proxy file-write behavior indicates potential WSL2 payload staging that bypasses network telemetry.
Page 7 of 17