Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications. Adversaries may use Diskshadow.exe to proxy execution of other commands or to inhibit system recovery by deleting shadow copies.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
Detects suspicious execution of AgentExecutor.exe, a Microsoft Intune component, when it is used to launch PowerShell scripts with potentially bypassed execution policies or to execute a 'powershell.exe' binary from a specified path. This behavior can be indicative of a Living Off The Land Binary (LOLBIN) abuse.
This rule detects the use of the 'dsacls.exe' utility to grant potentially over-permissive permissions on Active Directory objects. It specifically looks for the execution of 'dsacls.exe' with the '/G' flag, which is used to grant permissions, combined with common permission flags like 'GR' (Generic Read), 'GE' (Generic Execute), 'GW' (Generic Write), 'GA' (Generic All), 'WP' (Write Property), or 'WD' (Write DACL). This combination suggests an attempt to broaden access controls, which could be a legitimate administrative action or an adversary attempting to escalate privileges or maintain persistence.
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software. This rule specifically looks for the 'update.exe' process within the 3CXDesktopApp directory being executed with command-line arguments indicating an update operation for version '18.12' via HTTP, which was associated with the supply chain compromise.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
Detects the use of the .NET utility InstallUtil.exe to download files from remote HTTP or FTP sources. This technique is often used by adversaries to bypass application control and execute malicious code by leveraging a trusted, signed Microsoft binary.
Detects the execution of a renamed MegaSync.exe, which has been observed in use by ransomware families such as Nefilim, Sodinokibi (REvil), Pysa, and Conti. The rule specifically looks for processes where the original filename metadata is 'megasync.exe' but the executed image path does not end with '\megasync.exe', indicating a renaming event.
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
Detects the creation of Usage Log files by the CLR (clr.dll) for specific system binaries. These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context. This activity can be indicative of defense evasion techniques where adversaries use trusted binaries to proxy execution of malicious code, and the CLR usage logs can reveal this activity.
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
Detects the execution of the `AgentExecutor.exe` binary when it is used to execute PowerShell scripts. This binary can be abused as a Living Off The Land Binary (LOLBIN) to run PowerShell scripts with the ExecutionPolicy set to "Bypass" or to execute any binary named "powershell.exe" located in a path provided as the 6th positional argument. The rule specifically looks for `AgentExecutor.exe` being executed with command-line arguments indicating PowerShell script execution, such as `-powershell` or `-remediationScript`. It filters out legitimate usage where the parent process is `Microsoft.Management.Services.IntuneWindowsAgent.exe`.
Detects uncommon child processes spawned by 'BgInfo.exe' or 'BgInfo64.exe'. This behavior can indicate an adversary abusing BgInfo, a legitimate Microsoft utility, to proxy execution of malicious code, potentially via external VBScript, as part of defense evasion or execution tactics.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
This rule detects indirect command execution by monitoring for processes where 'pcwrun.exe' is the parent process. 'pcwrun.exe' is part of the Program Compatibility Assistant and can be abused to proxy execution of other commands or binaries, a technique often used for defense evasion.
Detects the usage of the "sftp.exe" binary as a Living Off The Land Binary (LOLBIN) by abusing the "-D" flag to potentially execute arbitrary commands or binaries. This technique can be used for defense evasion or execution.
Page 41 of 45