Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects execution of executables that can be used to bypass Applocker whitelisting
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Detects execution of Cmdl32 with the "/vpn" and "/lan" flags.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Detects when verclsid.exe is used to run COM object via GUID
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Detects the "iexpress.exe" utility creating self-extracting packages.
Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Detects file execution using the msdeploy.exe lolbin
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.
This utility can be abused in order to run custom COM object created in the registry.
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.
Detects the creation of a child "explorer.exe" process from a shell like process such as "cmd.exe" or "powershell.exe".
Attackers can use "explorer.exe" for evading defense mechanisms by proxying the execution through the latter.
While this is often a legitimate action, this rule can be use to hunt for anomalies.
Muddy Waters threat actor was seeing using this technique.
Attackers can use "explorer.exe" for evading defense mechanisms by proxying the execution through the latter.
While this is often a legitimate action, this rule can be use to hunt for anomalies.
Muddy Waters threat actor was seeing using this technique.
Detects suspicious .NET assembly executions. Could detect using Cobalt Strike's command execute-assembly.
Page 28 of 45