Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique leverages a legitimate Windows binary to proxy the execution of malicious commands, often for defense evasion.
Detects the creation of a PowerShell module where the module contents specifically include "function Get-VMRemoteFXPhysicalVideoAdapter". This pattern is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. An attacker might use this technique to execute arbitrary code by tricking the legitimate signed binary into loading a malicious PowerShell module.
This rule detects the execution of 'ScriptRunner.exe' with the '-appvscript' command-line argument. 'ScriptRunner.exe' is a legitimate Windows binary that can be abused to proxy execution, potentially bypassing whitelisting or other security controls. This specific command-line argument indicates its use in the context of App-V scripting, which can be leveraged for malicious purposes.
Detects child processes of 'provlaunch.exe' which might indicate potential abuse to proxy execution. Adversaries may use 'provlaunch.exe', a legitimate Windows binary, to execute arbitrary commands or binaries, bypassing security controls or masquerading malicious activity.
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries. This technique is often used for defense evasion by proxying execution of malicious content with a trusted, signed binary.
Detects potential abuse of "ShellDispatch.dll" functionality to execute arbitrary binaries via "ShellExecute" using rundll32.exe. This technique involves rundll32.exe being executed with a command line containing 'RunDll_ShellExecuteW'.
This rule detects when the 'DLLPath' registry value for WAB.exe is modified to point to a DLL path different from the default one. WAB.exe is a legitimate Windows binary that can be abused to load arbitrary DLLs, a technique often used for defense evasion and persistence.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This rule detects potential NTLM coercion attempts using the built-in Windows utility 'certutil.exe'. Specifically, it looks for command-line executions of 'certutil.exe' that include both the '-syncwithWU' flag and a UNC path (indicated by '\\'). This combination is known to be abused by attackers to force a Windows machine to authenticate to an attacker-controlled server, thereby coercing it to send its NTLM hash.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
This rule detects the execution of 'DeviceCredentialDeployment.exe', a legitimate Windows binary that can be abused to hide processes from view. This technique is often used for defense evasion.
This rule detects the execution of msdeploy.exe with specific command-line arguments that indicate an attempt to execute arbitrary commands. Adversaries may abuse msdeploy.exe, a legitimate Microsoft utility, to proxy execution of malicious content, bypassing security controls that monitor for direct execution of suspicious binaries. The rule specifically looks for the 'verb:sync', '-source:RunCommand', and '-dest:runCommand' arguments in conjunction with msdeploy.exe, which are indicative of this technique.
Detects when OpenWith.exe is used to execute another binary, indicated by the presence of '/c' in the command line. This technique can be used by adversaries to bypass process and/or signature-based defenses by proxying execution with a trusted binary.
Detects the execution of msdt.exe by a suspicious parent process, which is indicative of exploitation techniques such as the 'Follina' vulnerability (CVE-2022-30190). The rule specifically looks for msdt.exe being spawned by common scripting or system utility processes often abused in such attacks.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Detects the use of 'PresentationHost.exe', a utility designed to run '.xbap' (Browser Applications) files, when it attempts to download arbitrary files from HTTP, HTTPS, or FTP sources. This behavior can be abused for defense evasion and execution of malicious content.
This rule detects attempts to abuse the `print.exe` utility for remote file copy operations. Attackers can leverage `print.exe`, a legitimate Windows binary, to transfer files by specifying a remote destination using the `/D` switch and a file with an `.exe` extension. This technique is often used for defense evasion by proxying execution with a trusted system binary.
This rule detects when `Microsoft.NodejsTools.PressAnyKey.exe` spawns a child process. This executable is part of Visual Studio's Node.js tools and is designed to pause execution until a key is pressed. However, it can be abused to proxy the execution of arbitrary binaries, allowing an attacker to bypass certain security controls or execute malicious code under the guise of a legitimate Visual Studio component.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and make network connections. This rule specifically looks for wuauclt.exe making network connections with the '/RunHandlerComServer' command-line argument, while filtering out common internal IP ranges and known Microsoft update server IP ranges to reduce false positives. It also filters out specific command-line patterns related to legitimate Windows Update deployments.
Page 42 of 45