Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
933 detections
Filters
Last updated
All Time
Detection languages
661
151
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
36
34
Platforms
924
6
2
1
Products / Services
286
207
113
22
18
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
933
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software
Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter
Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs
VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Detects uncommon child processes of Appvlp.EXE
Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands.
Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder
or to mark a file as a system file.
Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands.
Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder
or to mark a file as a system file.
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.
Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
Detects usage of "MSOHTMED" to download arbitrary files
Page 35 of 45