Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
The Devtoolslauncher.exe executes other binary
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path.
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.
Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location.
When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.
When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
'This detection uses Normalized Process Events to hunt Signed Binary Proxy Execution: Rundll32 activities'
Detects code execution via the Windows Update client (wuauclt)
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
Detects specific process behavior observed with Devil Bait samples
Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software
Page 34 of 45