Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
Detects instances where the VLC Media Player process (vlc.exe) acts as the parent to common LOLBAS (Living Off the Land Binary and Script) executables such as cmd.exe, powershell.exe, and others. This pattern is often indicative of exploitation attempts or malicious activity where a compromised or trojanized application triggers secondary payloads.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule detects potentially malicious usage of the Windows RegSvcs.exe binary, often used as a proxy for executing code. It monitors for two specific patterns: RegSvcs.exe being executed from user-writable directories (e.g., C:\Users\, C:\ProgramData\), or RegSvcs.exe spawning suspicious child processes (e.g., PowerShell, cmd, WScript, mshta), which is indicative of a living-off-the-land (LotL) attack technique to bypass application control or execute payloads.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
Detects potential abuse of Microsoft Defender’s BTR boot-time remediation driver by correlating known driver loads with BootClean.log activity, unexpected loader processes, and driver execution outside normal Defender paths.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
Detects the loading of WMI-related DLLs (wbemcomn.dll, wbemprox.dll) by processes that are commonly abused to proxy execution (LOLBins) such as certutil, mshta, or office applications. This behavior is often associated with WMI-based persistence or execution techniques.
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
The following analytic identifies public network connections initiated by Living Off the Land Binaries and Scripts (LOLBAS) that rarely require direct outbound network access.
It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved.
This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls.
Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function.
Exclude said processes from the detection if they are too noisy for your environment.
Join this detection with the Process Execution events to provide context and avoid false positives.
It leverages the Network Traffic data model and focuses on native Windows binaries where any public destination should be investigated and explicitly approved.
This activity may indicate proxy execution, process injection, payload download, command-and-control, or other abuse of trusted binaries to evade security controls.
Keep in mind that some of these binaries, such as Netsh.exe, Gpscript.exe, Wmic.exe, etc., will occasionally communicate with public network resources to perform their intended function.
Exclude said processes from the detection if they are too noisy for your environment.
Join this detection with the Process Execution events to provide context and avoid false positives.
Detects instances where the Kaspersky antivirus process (avp.exe) spawns potentially malicious or administrative binaries like cmd.exe, powershell.exe, or specific artifacts related to 'HardBreacher'. This behavior is highly irregular as antivirus software typically does not initiate these types of processes under high-privilege tokens.
Detects instances where Microsoft Outlook (OUTLOOK.EXE) initiates common living-off-the-land (LotL) binaries that are often abused by malicious attachments or macros to execute secondary commands, such as PowerShell, command prompt, or script host engines.
Detects the execution of BrowserCore.exe, a native messaging component for web browsers, when combined with command-line redirection (< or >) or specific output file creation (e.g., prt_cookie.txt, formatted_nonce.txt). This behavior is characteristic of an attack designed to extract Primary Refresh Tokens (PRTs) or browser cookies, which can be used to bypass authentication mechanisms.
Detects the abuse of the Windows ftp.exe utility to execute a local script file provided via the -s flag. Adversaries may leverage this behavior, often triggered by malicious LNK files, to proxy the execution of commands or scripts.
Page 5 of 45