Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the usage of "msedge_proxy.exe" to download arbitrary files by looking for its execution with command-line arguments containing 'http://' or 'https://'. This behavior can be abused for defense evasion and execution.
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path. This behavior is often abused by adversaries to execute malicious DLLs for defense evasion.
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
Detects the execution of Microsoft Workflow Compiler (Microsoft.Workflow.Compiler.exe), which can be abused to execute arbitrary unsigned code. This utility is part of the .NET Framework and can compile and execute workflow definition files. Adversaries may leverage this for defense evasion and execution by proxying malicious code through a trusted, signed binary.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
Detects the execution of "Extexport.exe", a utility that is part of the Internet Explorer browser. This utility can be abused for DLL sideloading, specifically by loading "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll" if a folder is provided in the command line, or arbitrary DLLs if specific flags are used. This behavior is associated with malware like Astaroth and Guildma.
Detects the execution of Xwizard.EXE with the "RunWizard" flag and a GUID-like argument, which indicates an attempt to abuse this utility to run custom COM objects created in the registry. This technique is often used for defense evasion.
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Detects uncommon or suspicious child processes spawning from a Windows Subsystem for Linux (WSL) process. This behavior can indicate an attempt to evade parent/child relationship detections, or persistence attempts using cron within WSL. The rule specifically looks for common Windows LOLBINs (Living Off the Land Binaries) or processes launched from suspicious temporary or user-controlled directories, originating from wsl.exe or wslhost.exe.
This rule detects potential password spraying attempts that leverage the built-in Windows utility `dsacls.exe`. Specifically, it looks for executions of `dsacls.exe` where the command line includes both the `/user:` and `/passwd:` arguments, indicating an attempt to bind to an LDAP session with specified credentials. This technique can be used by attackers to test a single password against multiple user accounts to avoid account lockouts.
Detects suspicious child processes spawned by common Windows shell and scripting processes such as mshta.exe, powershell.exe, rundll32.exe, cscript.exe, wscript.exe, wmiprvse.exe, and regsvr32.exe. The suspicious child processes include schtasks.exe, nslookup.exe, certutil.exe, bitsadmin.exe, and mshta.exe, which are often abused for various malicious activities like persistence, data exfiltration, or further execution.
This rule detects the creation of an 'explorer.exe' child process from common shell processes such as 'cmd.exe', 'powershell.exe', or 'pwsh.exe'. Attackers may use 'explorer.exe' as a proxy for execution to evade defense mechanisms. While this activity can be legitimate, it is often indicative of anomalous behavior and has been observed in use by threat actors like Muddy Waters.
Detects Dllhost.EXE initiating an outbound network connection to a non-local IP address. Dllhost.exe is a legitimate Windows process that hosts DLL-based COM+ applications. While legitimate network communication from Dllhost.exe can occur, especially for applications it hosts, unexpected connections to external IP addresses (excluding known Microsoft ranges and local networks) can indicate malicious activity. Adversaries may abuse Dllhost.exe for proxy execution or to establish command and control.
This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.
Detects suspicious child processes spawned by "BgInfo.exe" or "BgInfo64.exe". This behavior can indicate an attempt to abuse BgInfo, a legitimate Microsoft utility, for proxy execution of other binaries or scripts, often to bypass application whitelisting or other security controls. The rule specifically looks for common command-line interpreters (cmd.exe, powershell.exe, cscript.exe, wscript.exe), other executables (calc.exe, notepad.exe, mshta.exe), or executables launched from suspicious user-writable directories (AppData, Users\Public, Temp, PerfLogs).
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline. The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Attackers abuse this utility to install malicious MOF scripts.
Detects the execution of SyncAppvPublishingServer.exe, which can be abused by adversaries to bypass PowerShell execution restrictions. This rule specifically looks for the string 'SyncAppvPublishingServer.exe' within the 'ContextInfo' field of PowerShell module logs, indicating its use in a PowerShell context.
Detects the execution of non-standard or uncommon assistive technology applications via "AtBroker.exe". AtBroker.exe is a legitimate Windows binary that can be abused to proxy the execution of other programs, often for defense evasion or persistence. This rule specifically looks for instances where AtBroker.exe is used to start applications that are not part of the common, built-in Windows assistive technologies.
Detects the use of 'cdb.exe', a legitimate Windows debugger, to execute arbitrary processes or commands. This technique is often used by adversaries to bypass application whitelisting or execute malicious code through a trusted binary. The rule specifically looks for command-line arguments indicative of debugger script execution ('-c' or '-cf').
Detects the execution of SyncAppvPublishingServer.exe, which is often used by adversaries to bypass PowerShell execution restrictions. This technique is part of the LOLBAS (Living Off The Land Binaries and Scripts) project, where legitimate system binaries are abused for malicious purposes, specifically to execute PowerShell commands in a way that might evade traditional security controls.
This rule detects the execution of arbitrary PowerShell code using SyncAppvPublishingServer.exe. Adversaries may abuse this legitimate Windows binary to proxy execution of malicious PowerShell commands, often as a method of defense evasion and to bypass PowerShell execution restrictions. The detection specifically looks for the execution of 'SyncAppvPublishingServer.exe' or 'syncappvpublishingserver.exe' with a command line containing '"n; ' which is a known pattern for invoking PowerShell via this binary.
Page 40 of 45