Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects winget.exe executing the 'configure' subcommand, which subsequently launches 'ConfigurationRemotingServer.exe'. This pattern is associated with potential abuse of Windows Desired State Configuration (DSC) to execute arbitrary code or scripts embedded within DSC configuration files, bypassing standard PowerShell execution monitoring mechanisms.
Detects the execution of ConfigurationRemotingServer.exe by WindowsPackageManagerServer.exe when the parent process is not winget.exe. This pattern is indicative of unauthorized attempts to invoke the Windows Package Manager DSC (Desired State Configuration) engine directly, bypassing standard tooling and potentially indicating an attempt to leverage COM interface abuse for code execution.
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
This rule detects instances where Microsoft Management Console (mmc.exe) spawns a hidden PowerShell process that attempts to execute commands using 'IEX' (Invoke-Expression) combined with 'DownloadString' or 'Net.WebClient'. This pattern is commonly associated with malicious activity, such as downloading and executing payloads from a remote source, often to evade detection.
Detects PowerShell executing 'Add-AppxPackage -Register' with a UNC path, which is a core primitive of the UNCanny InstallService coercion attack. This indicates an attempt to register a loose-file AppX package from a network share.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
This rule detects the execution of rundll32.exe where it attempts to load a DLL from common user-writable directories (Temp, AppData, Downloads, Users\Public) and specifically calls the 'Begin' export function. This behavior is often associated with malware attempting to execute malicious code via a legitimate Windows binary.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
Detects the Bumblebee loader technique where a trojanized installer drops the legitimate Windows binary consent.exe and a malicious msimg32.dll into a temporary directory. The rule flags instances where consent.exe loads msimg32.dll from an AppData subfolder, indicating a DLL search order hijacking attempt rather than loading the trusted system library.
Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.
Detects a utility-themed parent process launching msiexec with a ScreenConnect or remote support installer and quiet options. This behavior is often associated with adversaries attempting to establish remote access covertly.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe, indicating active DSC processing. This is a strong indicator of WinGet DSC execution, which is abused by tools like DSCourier.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launch suspicious child processes often associated with malicious command execution, such as command shells, scripting interpreters, or system utilities.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.
This rule detects a specific kill chain involving PowerShell executing ClickFix, followed by rundll32 loading Matanbuchus, and finally, an AstarionRAT executable running from the AppData folder. The detection logic links these events by device ID and within specific timeframes (5 minutes between ClickFix and Matanbuchus, and 10 minutes between Matanbuchus and AstarionRAT).
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.
Page 10 of 45