Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Attackers might abuse this in order to bypass application whitelisting.
Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Detects commandline arguments for executing a child process via dotnet-trace.exe
Detects usage of Dsacls to grant over permissive permissions
Detects possible password spraying attempts using Dsacls
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
This behavior has been observed in-the-wild by different threat actors.
This behavior has been observed in-the-wild by different threat actors.
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
Detects an uncommon parent process of "LINK.EXE".
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
The Devtoolslauncher.exe executes other binary
Gpscript Execution
Sigma
Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
MpiExec Lolbin
Sigma
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
The OpenWith.exe executes other binary
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Page 16 of 45