Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the execution of the Add-In deployment cache updating utility (AddInUtil.exe) when it is used with suspicious AddInRoot or PipelineRoot paths. Adversaries may leverage this legitimate utility to load their malicious add-ins by pointing to uncommon or user-controlled directories like temporary folders, desktop, downloads, or public user directories. This technique can be used for defense evasion by proxying execution through a trusted binary.
Detects the use of "devinit.exe" with specific command-line arguments to download arbitrary MSI packages. This technique can be abused as a Living Off The Land Binary (LOLBIN) to perform malicious downloads on a Windows system.
Detects the execution of Dnx.EXE, which can be abused by attackers to bypass application whitelisting by executing C# code.
This rule detects the execution of ZipExec, a Proof-of-Concept (POC) tool designed to wrap binary-based tools into a password-protected zip file. It specifically looks for command-line arguments indicative of ZipExec's 'run' functionality (extracting and executing a zip file with a password) or 'delete' functionality (deleting the extracted files). The detection relies on specific strings like '/generic:Microsoft_Windows_Shell_ZipFolder:filename=', '.zip', '/pass:', '/user:' for 'run' operations, and '/delete', 'Microsoft_Windows_Shell_ZipFolder:filename=', '.zip' for 'delete' operations.
Detects the execution of the LOLBIN (Living Off the Land Binaries and Scripts) `gpscript.exe` when it is used to execute logon or startup scripts configured in Group Policy. This rule specifically looks for `gpscript.exe` being executed with the `/logon` or `/startup` command-line arguments, while filtering out legitimate executions where `gpscript.exe` is parented by `svchost.exe` with the `gpsvc` service.
Detects the use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file when ie4uinit.exe is not run from its usual system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). This behavior is indicative of an adversary attempting to bypass defenses by proxying execution with a trusted system binary.
Detects the execution of "msdt.exe" with an answer file, specifically looking for command-line arguments that indicate the use of a diagnostic answer file (PCWDiagnostic.xml) and an answer file flag (-af or /af). This activity is suspicious because it bypasses the legitimate parent process "pcwrun.exe", which is typically used when MSDT is called from the compatibility tab.
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects the execution of 'runexehelper.exe' as a parent process, indicating its use as a proxy to launch other programs. This technique is often used for defense evasion by leveraging a legitimate, signed binary to execute malicious code.
Detects the usage of Microsoft Publisher (MSPUB.exe) to download arbitrary files from remote locations (FTP, HTTP, HTTPS). This technique can be abused by adversaries to bypass application control and execute malicious content.
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files and bypass application allowlisting.
This rule detects the use of "ProtocolHandler.exe" to download files from the internet. "ProtocolHandler.exe" is a legitimate Windows binary that can be abused to download files, often placing them in the Internet Explorer cache folder. The detection specifically looks for the execution of "ProtocolHandler.exe" combined with command-line arguments containing common internet protocols like 'ftp://', 'http://', or 'https://'. This behavior is indicative of System Binary Proxy Execution (T1218) where a trusted binary is used to perform malicious actions, potentially bypassing security controls.
Detects suspicious child processes spawned by "provlaunch.exe". This behavior indicates potential abuse of "provlaunch.exe" for proxy execution, where a legitimate signed binary is used to execute other malicious or suspicious binaries, often for defense evasion. The rule specifically looks for common Windows utilities or executables in suspicious temporary or user-writable directories being launched as children.
Detects the use of stordiag.exe, a legitimate Windows utility, to execute other system binaries like schtasks.exe, systeminfo.exe, and fltmc.exe. This behavior can be indicative of an adversary attempting to bypass defenses by proxying execution through a trusted binary, a technique often associated with System Binary Proxy Execution (T1218). The rule specifically filters out executions where stordiag.exe is launched from its default system paths to reduce false positives, focusing on instances where it might be copied or used from non-standard locations.
This rule detects the execution of 'te.exe', the Windows Test Authoring and Execution Framework (TAEF) executable. Adversaries can abuse 'te.exe' to proxy the execution of malicious scripts or binaries, such as Windows Script Components (WSC) files containing VBScript or DLLs, thereby bypassing security controls. The rule specifically looks for 'te.exe' being executed as the main image, a parent image, or identified by its original filename.
This rule detects the execution of a new process where the parent process is `vsjitdebugger.exe`, the Microsoft Visual Studio Just-In-Time Debugger. Adversaries may abuse this legitimate, signed binary to proxy the execution of malicious code, thereby evading defenses that trust signed executables. The rule includes exclusions for common legitimate child processes of `vsjitdebugger.exe` to reduce false positives.
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
Detects uncommon child processes spawned by Appvlp.EXE. Appvlp.EXE, or Application Virtualization Utility, is part of Microsoft Office and can be abused by attackers to execute shell commands, bypass ASR file path rules, or mark files as system files. This rule specifically looks for child processes that are not commonly associated with legitimate Appvlp.EXE operations, such as rundll32.exe, msoasb.exe, skypeserver.exe, and msouc.exe.
This rule detects the execution of `Cmdl32.exe` with the `/vpn` and `/lan` flags. Attackers can abuse this legitimate Windows utility to download arbitrary files by providing a malicious configuration file. The rule advises inspecting the location and content of the file passed as an argument to determine if it is suspicious.
This rule detects when 'DefaultPack.exe' launches any child process. 'DefaultPack.exe' is a legitimate Microsoft binary that can be abused by adversaries to proxy execution of other programs, often for defense evasion. The rule aims to identify suspicious activity where this binary is used to launch unexpected or malicious child processes.
Page 43 of 45