Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Detects suspicious command-line strings within the 'TypedPaths' registry key, specifically targeting entries associated with web browsers. This behavior is indicative of the "FileFix" technique, where users are tricked into pasting malicious commands into browser file upload dialogs. The rule looks for common command-line utilities like 'cmd', 'curl', 'powershell', 'bitsadmin', 'certutil', 'mshta', and 'regsvr32' within the 'url1' value of the 'TypedPaths' key, combined with the presence of a '#' character, which often signifies a comment or a separator in such malicious constructs.
Detects execution of mshta.exe from PowerShell, often used for malware delivery via malicious URLs.
Detects execution of mshta.exe from explorer.exe with an inline HTA script that reads and executes code from the registry.
Detects suspicious execution of mshta.exe from cmd.exe with embedded JavaScript and registry modifications.
Detects execution of mshta.exe with inline scripting using protocol handlers (vbscript, javascript, about)
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query from file: FileFix Detection
KQL Query
KQL Query from file: Potential Notepad++ CVE-2025-49144 Exploitation
Detect usage of the "ssh.exe" binary as a proxy to launch other programs.
KQL Query from file: Suspicious MSHTA Usage
KQL Query from file: Detecting Windows Downdate Abuse
Detect usage of the "ssh.exe" binary as a proxy to launch other programs.
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.
Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa.
It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll".
Arbitrary DLLs can also be loaded if a specific number of flags was provided.
It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll".
Arbitrary DLLs can also be loaded if a specific number of flags was provided.
Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE
The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"
The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"
Page 24 of 45