Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
Detects the execution of "dotnet-dump" with the "collect" flag, which can indicate potential process dumping of critical processes like LSASS. This tool is part of the .NET Core diagnostics and can be legitimately used for debugging, but its use to collect memory dumps of sensitive processes could be malicious.
Detects the execution of arbitrary binaries or commands by leveraging the Notepad++ updater (gup.exe). This technique can be used by adversaries to bypass application whitelisting or execute malicious code under the guise of a legitimate process.
This rule detects the execution of 'InfDefaultInstall.exe' with an '.inf' file specified on the command line. This behavior is commonly abused by adversaries to proxy execution of malicious code, often to bypass application whitelisting or other security controls. The tool 'InfDefaultInstall.exe' is a legitimate Windows binary used to install INF files, but it can be leveraged to execute commands embedded within a specially crafted INF file, including SCT scripts via 'scrobj.dll'.
This rule detects the execution of "LINK.EXE" with an uncommon parent process. LINK.EXE is a Microsoft incremental linker, typically bundled with Visual Studio. Other utilities like editbin.exe, dumpbin.exe, and lib.exe often hardcode calls to "LINK.EXE" without validating its path. This behavior can be exploited by an attacker to sideload a malicious binary named "link.exe" if one of these legitimate tools is executed from an unexpected location. The rule filters out known legitimate parent processes from Visual Studio installation paths to identify suspicious executions.
This rule detects when 'devtoolslauncher.exe' is executed with the 'LaunchForDeploy' command-line argument. This behavior is indicative of 'devtoolslauncher.exe' being used to proxy the execution of another binary, which can be abused by adversaries for defense evasion.
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application. This technique can be used by adversaries for defense evasion by proxying execution of malicious content with a trusted binary.
This rule detects the execution of 'VisualUiaVerifyNative.exe', a legitimate Microsoft Windows SDK tool. This executable has been identified as a potential method for bypassing Application Whitelisting (AWL) solutions like Windows Defender Application Control (WDAC) and is included in Microsoft's recommended block rules for such bypasses. Adversaries may abuse this signed binary to proxy execution of malicious code, thereby evading defenses.
Detects the use of Windows Defender's MpCmdRun.exe utility to download files from a specified URL. This technique can be abused by adversaries for ingress tool transfer or to bypass security controls by using a legitimate, signed Microsoft binary.
This rule detects the creation of a child process named 'choice' by 'setres.exe', which is an uncommon and potentially malicious behavior. Setres.exe is a legitimate Windows server tool used to set screen resolution, but it can be abused to launch arbitrary executables, especially those with 'choice' in their name, from the current execution path. The rule specifically filters out legitimate instances of 'choice.exe' located in 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'.
Detects execution of "VSDiagnostics.exe" with the "start" or "launch" command-line arguments to proxy the execution of arbitrary binaries. This technique can be used by adversaries to bypass defenses by leveraging a legitimate, signed Microsoft binary.
Detects Microsoft Visual Studio vsls-agent.exe execution with a suspicious library load using the --agentExtensionPath parameter. This technique can be used to proxy execution of malicious code by abusing a legitimate signed binary.
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution of other commands or binaries. Adversaries may abuse this legitimate Windows binary to bypass defenses and execute malicious code. The rule specifically looks for wuauclt.exe being executed with command-line arguments that indicate proxy execution, while filtering out common legitimate uses of the binary related to Windows Update deployment.
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe". This technique is often used to bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.
Detects potential abuse of the "register_app.vbs" script, which is part of the Windows SDK. This script can register new VSS/VDS Providers as COM+ applications. Attackers may leverage this functionality to install malicious DLLs for persistence and execution.
This rule detects the execution of 'MSOHTMED.exe' when its command line contains URL indicators such as 'ftp://', 'http://', or 'https://'. MSOHTMED.exe is a legitimate Microsoft Office component (HTML Editor) that can be abused to download arbitrary files from the internet, acting as a living-off-the-land binary (LOLBIN). This behavior can be used by adversaries for defense evasion and execution of malicious content.
Detects the execution of 'control.exe' as a child process of 'WorkFolders.exe', specifically when 'control.exe' is not launched from its default system directory. This behavior can indicate an attempt to bypass security defenses by proxying execution through a trusted Windows binary.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.
Page 44 of 45