Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
This rule detects the execution of Windows Explorer (explorer.exe) with specific command-line arguments involving a factory initialization sequence and an embedding flag. This command line pattern is typically associated with shell object manipulation or specific COM object instantiation, which may be leveraged for process injection or hiding malicious activity.
Detects the execution of Google Chrome or Microsoft Edge in headless mode with the Chrome DevTools Protocol (CDP) remote debugging port enabled. This configuration allows external control of the browser instance and is often abused by attackers to perform browser-based attacks, intercept traffic, or exfiltrate session data.
This rule detects sequences of suspicious process activity where multiple known LOLBins (Living Off the Land Binaries) execute in a chain. Specifically, it monitors for scenarios where a process from a predefined list (e.g., msdt.exe, mmc.exe, rundll32.exe) initiates another process from the same list, often indicative of proxy execution or privilege escalation techniques involving suspicious command-line parameters like '-embedding', 'NtLoadDriver', or '/i:'.
This rule detects sequences of suspicious process activity where multiple known LOLBins (Living Off the Land Binaries) execute in a chain. Specifically, it monitors for scenarios where a process from a predefined list (e.g., msdt.exe, mmc.exe, rundll32.exe) initiates another process from the same list, often indicative of proxy execution or privilege escalation techniques involving suspicious command-line parameters like '-embedding', 'NtLoadDriver', or '/i:'.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects executables launched by common LOLBins (msiexec, powershell, cmd, wscript, cscript, regsvr32, rundll32)
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
that are either signed by a non-Microsoft/non-trusted-third-party publisher, or entirely unsigned.
Detects a renamed AutoHotkey interpreter executable (masquerading as another binary via its version-info OriginalFileName field) running from a Temp, Downloads, or AppData folder with no command-line arguments and a co-located, same-named .ahk script file created within an hour, consistent with the AutoHotkey stager technique used by UNC6692 to deploy the Edgecution malware suite.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects the Abyssos UAC_BYPASS_ICMLUAUTIL technique: a process referencing the ICMLuaUtil COM interface/CLSID that ends up running at High/System integrity without going through consent.exe.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects a process chain where mshta.exe is spawned by and descends from mshta.exe, executing a command line referencing a remote HTTP/HTTPS URL, consistent with CountLoader delivery observed in DOUBLECUP LaaS ClickFix campaigns.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other script interpreters, which may indicate web-based exploitation or lateral movement.
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects the execution of Chrome or Edge browsers with --headless and --remote-debugging-port command-line flags when launched by suspicious or non-standard parent processes. This behavior is commonly associated with msaRAT, which leverages the Chrome DevTools Protocol (CDP) to establish a covert Command and Control (C2) channel through a headless browser instance.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects the execution of Google Chrome or Microsoft Edge in headless mode by the Windows Installer service (msiexec.exe), utilizing remote debugging ports and custom user-data directories. This behavior is indicative of browser-hijacking techniques, such as those observed in msaRAT, used to establish covert C2 channels by manipulating the browser's CDP interface.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
Page 6 of 45