Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
Detects the execution of 'finger.exe' or a renamed version (e.g., 'ct.exe') when its command line contains an '@' symbol and either 'http', 'https', or a '.' (dot). This pattern is indicative of the LOLBin 'finger.exe' being used to communicate with an external C2 server, as observed in CrashFix/ModeloRAT campaigns.
Hunts for the reflective .NET loader dynamically invoking methods while spawning RegAsm.exe as the execution proxy. This rule detects when 'RegAsm.exe' is spawned by 'powershell.exe' and is associated with an 'AllocateVirtualMemoryApiCall' event, indicating potential reflective code loading and execution.
Detects use of Forfiles for indirect command execution to evade detection
This rule spots signed fake AI software that launches trusted Windows utilities in unusual ways to hide malicious activity. Attackers abuse built-in tools so security software trusts the chain. Examine the parent installer and child commands. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Correlates the execution of the TiFlux installer leveraging silent, unattended installation flags to hide its deployment from the user.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Detects CMSTP used with INF files for UAC bypass and code execution
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects abuse of legitimate Windows binary AgentExecutor.exe, executing powershell scripts. Correlation rule
Detects use of Forfiles for indirect command execution to evade detection
Detects the execution of Windows processes where the parent process is wsl.exe. This indicates WSL interop functionality being used to execute host-side binaries from within the Linux environment, a technique often used to trigger staged payloads.
This rule detects the execution of Living Off The Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, regasm.exe, rundll32.exe, cscript.exe, and wscript.exe, when their command lines contain keywords indicative of malicious activity like 'download', 'encode', 'decode', 'http', 'ftp', or 'javascript'. It specifically filters out executions originating from explorer.exe or svchost.exe to reduce false positives and triggers when two or more such events occur within an hour on the same computer by the same user.
Page 11 of 45