Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects suspicious child processes spawned by 'SpeechRuntime.exe'. This activity is indicative of potential lateral movement attempts, specifically through COM & DCOM hijacking, where 'SpeechRuntime.exe' is abused as a proxy for execution.
Detects the execution of Winrs.exe where it is used to execute commands locally. Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe) accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers instead of legitimate system binaries. The vulnerability allows unauthorized code execution through external control of file names or paths via WebDAV.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 which involves unauthorized code execution via WebDAV through external control of file names or paths. The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating their working directories to point to attacker-controlled WebDAV servers, causing them to execute malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries through Process.Start() search order manipulation.
Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.
Detects potential suspicious child processes spawned by '3CXDesktopApp.exe', which could indicate compromise related to the 3CXDesktopApp supply chain attack. Specifically, it looks for the 3CXDesktopApp spawning common system binaries often abused for execution, command and control, or defense evasion.
The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security.
This rule detects the creation of suspicious executable files (.dll or .exe) by Microsoft Sync Center (mobsync.exe). While mobsync.exe is a legitimate Windows process for synchronizing offline files, its use to create executable files can be indicative of malicious activity, such as persistence, defense evasion, or privilege escalation, where an attacker might be attempting to drop and execute malicious payloads using a trusted system binary.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.
This rule detects the execution of a renamed 'dctask64.exe' binary. 'dctask64.exe' is a legitimate, signed executable by ZOHO Corporation, part of ManageEngine Endpoint Central. Adversaries can abuse this binary for malicious purposes such as DLL injection, arbitrary command execution, and process execution. The detection logic specifically looks for process creation events where the image hash matches known hashes of 'dctask64.exe' but the filename is not 'dctask64.exe', indicating a potential masquerading attempt.
This rule detects the execution of 'csi.exe' or 'rcsi.exe', which are signed Microsoft binaries associated with Visual Studio. These executables provide C# interactive capabilities and can be abused by adversaries to run arbitrary C# code from a file, potentially bypassing application whitelisting and enabling execution or defense evasion. The rule specifically looks for the process image ending with '\csi.exe' or '\rcsi.exe' or the original filename being 'csi.exe' or 'rcsi.exe', combined with the company name 'Microsoft Corporation'.
Detects suspicious outbound network connections initiated by Microsoft Sync Center (mobsync.exe) to non-private IP addresses. This activity is unusual for mobsync.exe, which typically handles offline file synchronization and should primarily communicate with internal network resources or specific cloud services, not arbitrary external IPs. Such connections could indicate compromise or malicious use of a legitimate system binary.
Detects the execution of 'regsvr32.exe' attempting to load a DLL with an uncommon or unrecognized file extension. This behavior is often associated with defense evasion techniques where adversaries use legitimate Windows binaries to proxy execution of malicious code, bypassing application whitelisting or other security controls.
Detects high-fidelity execution of executables spawned from Office applications or browsers after engaging with recruitment-themed lures (e.g., LinkedIn, careers). Focuses on EXE files created and executed within 24 hours in user directories (Downloads, Temp, AppData), reflecting Subtle Snail’s social engineering and document-based initial access methods.
The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for cryptocurrency wallets and credentials, and exfiltrate sensitive data. This activity is significant because BitLockerToGo.exe provides functionality for viewing, copying, and writing files as well as modifying registry branches - capabilities that the Lumma stealer exploits for malicious purposes. If confirmed malicious, this could indicate an active data theft campaign targeting cryptocurrency wallets, browser credentials, and password manager archives. The detection focuses on identifying BitLockerToGo.exe execution patterns that deviate from normal system behavior.
The following analytic detects the execution of an arbitrary DLL by the Windows Remote Auto Dialer (rasautou.exe). This behavior is identified by analyzing process creation events where rasautou.exe is executed with specific command-line arguments. This activity is significant because it leverages a Living Off The Land Binary (LOLBin) to execute potentially malicious code, bypassing traditional security controls. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, potentially leading to system compromise, privilege escalation, or persistent access within the environment.
Detects the execution of a renamed Microsoft Console Debugger (cdb.exe), a technique observed being used by the Jewelbug APT group for defense evasion and execution.
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.
Page 21 of 45