Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the expansion or decompression of cabinet files using 'expand.exe' from potentially suspicious or uncommon locations. This activity has been observed in attacks such as those related to Iranian MeteorExpress and Konni malware.
This rule detects the creation of self-extracting packages using iexpress.exe when the Self Extraction Directive (SED) file is located in potentially suspicious directories such as ProgramData, Temp, or Windows Tasks folders. This activity has been observed in-the-wild by various threat actors for defense evasion and payload delivery.
Detects when 'CertOC.exe' is used to load a DLL, which can be an indicator of System Binary Proxy Execution. Adversaries may abuse trusted Microsoft-signed binaries like CertOC.exe to bypass defenses and execute malicious code.
This rule detects suspicious activity involving `CertOC.exe` loading a DLL from unusual or temporary paths. `CertOC.exe` is a legitimate Windows binary used for certificate operations, but it can be abused to load arbitrary DLLs, a technique often used for defense evasion or privilege escalation. The rule specifically looks for `CertOC.exe` being executed with the `-LoadDLL` command-line argument, combined with the DLL path being located in common temporary or user-writable directories like `AppData\Local\Temp`, `Desktop`, `Downloads`, `Users\Public`, `C:\Windows\Tasks`, or `C:\Windows\Temp`.
Detects the execution of `findstr.exe` with both the `/s` (search subfolders) and `/i` (case-insensitive search) flags. Adversaries commonly use `findstr.exe` as a living-off-the-land binary (LOLBIN) to search for sensitive information, configuration files, or other interesting data within a compromised system, often filtering through command output or file contents.
This rule detects the use of the `curl` command-line tool to download a file from a remote HTTP/HTTPS source and immediately execute it. The detection logic specifically looks for `curl` in the command line, followed by an HTTP/HTTPS URL, the `-o` (output file) flag, and an `&` character, which often indicates command chaining for immediate execution. This behavior is commonly observed in adversaries attempting to transfer and execute malicious payloads.
Detects the execution of "Diskshadow.exe" in script mode with a potentially uncommon script extension. This rule requires initial baselining of allowed script extensions to minimize false positives. Adversaries may use Diskshadow.exe, a legitimate Windows utility, to proxy execution of malicious scripts, often as a defense evasion technique.
Detects the usage of the 'unregmp2.exe' binary as a proxy to launch a custom version of 'wmpnscfg.exe' by looking for the '/HideWMP' command-line argument. This technique is often used for defense evasion.
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag, which allows anything passed to it to be an argument of the ShellExecute API, potentially enabling an attacker to execute arbitrary binaries. This detection also identifies uncommon child processes spawned from "Wlrmdr.exe" as a supplementary measure for environments with "ParentImage" telemetry.
This rule identifies potentially suspicious signed binaries by looking for files with digital signatures from signers that are not commonly known or trusted vendors. It aims to detect the abuse of code signing certificates by threat actors to bypass security controls, leveraging the trust associated with digital signatures. The rule explicitly excludes a list of well-known and trusted software vendors to reduce false positives.
This rule identifies potentially suspicious signed binaries in the environment by looking for files signed by 'OneStart Technologies LLC' and excluding common, known good vendors. This helps detect the abuse of code signing certificates by threat actors to bypass security controls and can support threat hunting and malware analysis.
Detects the execution of a Bumblebee loader variant which uses rundll32.exe to launch its malicious DLL. This is immediately followed by the spawning of common reconnaissance commands to gather information about the compromised system and domain. This TTP was observed in the attack chain leading to Akira ransomware.
Aggregating and translating to KQL the collection of detection of LOLBINs from the LOLBAS project:
https://lolbas-project.github.io/
Some of the detections will likely be noisy based on the environment, so tuning is required before deploying. NRT applicable when running in Defender portal
https://lolbas-project.github.io/
Some of the detections will likely be noisy based on the environment, so tuning is required before deploying. NRT applicable when running in Defender portal
Detects the execution of regsvr32.exe with suspicious command-line parameters, often used by adversaries to execute malicious code (e.g., scripts, DLLs) from remote locations or local script files. This technique is a common LOLBAS method for proxy execution.
This detection monitors the execution of 7zG.exe—the 7-Zip GUI executable—specifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the user’s Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.
This detection was established prior to our discovery of this new execution technique. It was originally designed to identify a different method (which requires the user to click on the Taskpad after opening the MSC file) that exploits the same MSC file type to execute commands through the Console Taskpads command line attribute:
Detects Windows systems invoking rundll32.exe to execute DLLs associated with compromised npm package versions of eslint-config-prettier (10.1.6–10.1.9). These versions were published without corresponding GitHub commits and may initiate callbacks to FirebaseDotSu, indicating potential command-and-control activity.
Rundll32.exe is a built-in Windows utility that enables execution of DLL files by invoking specific functions exported from them. While it is used legitimately across various system operations, attackers frequently exploit it to execute malicious code because it is a trusted binary and less likely to trigger security alerts. This technique is recognized in the MITRE ATT and CK framework under the identifier T1218.011 as a method for defense evasion.
In typical usage scenarios, Node.js operates as a JavaScript runtime for developing applications and executing server-side scripts. It does not ordinarily engage with DLL files or initiate their execution through rundll32.exe.. When Node.js is observed invoking rundll32 to launch a DLL, this represents highly unusual behavior and may signal a compromise or malware deployment. Such activity warrants investigation, especially when linked to suspicious network callbacks or unverified software packages distributed through npm.
In typical usage scenarios, Node.js operates as a JavaScript runtime for developing applications and executing server-side scripts. It does not ordinarily engage with DLL files or initiate their execution through rundll32.exe.. When Node.js is observed invoking rundll32 to launch a DLL, this represents highly unusual behavior and may signal a compromise or malware deployment. Such activity warrants investigation, especially when linked to suspicious network callbacks or unverified software packages distributed through npm.
Detecting LOLDrivers using www.loldrivers.io and MDE telemetry.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
This rule was created by Mehmet Ergene from BluRaven Academy and added to Detections.ai as it was missing from the repository.
Detects suspicious command-line activity associated with the "ClickFix" social engineering technique.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
Page 23 of 45