Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects the use of living-off-the-land binaries (mshta.exe, regsvr32.exe, certutil.exe, or wmic.exe) when executing with network-related or decoding command-line arguments. The rule specifically flags these invocations when they originate from parent processes not typically associated with legitimate system administration or software deployment workflows, targeting potential command-chain abuse or payload staging.
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
Detects PowerShell execution involving reflection patterns (GetMethod('C') and Invoke) combined with the execution or targeting of known Living-off-the-Land binaries (LOLBins). This pattern is often used to execute malicious payloads in-memory, bypassing traditional signature-based detection.
This rule detects scenarios where Microsoft Office applications (Word, Excel, Outlook, PowerPoint, OneNote) spawn known suspicious child processes (LOLBAS) that exhibit command-line flags indicative of remote content retrieval or script execution (e.g., download strings, encoded commands) and subsequently initiate network connections to public IP addresses or URLs within a 15-minute window.
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Detects Microsoft Office applications spawning common LOLBAS (Living Off the Land Binaries and Scripts) such as PowerShell, CMD, WScript, or MSHTA. This activity is a common indicator of macro-based attacks or document-based exploitation attempting to execute arbitrary code or scripts.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects the creation of local user accounts or adding users to privileged groups triggered by ConfigurationRemotingServer.exe. This activity is indicative of potential misuse of the WinGet DSC (Desired State Configuration) capability to maintain persistence or escalate privileges on a Windows host, a technique observed in the DSCourier malware.
Detects the execution of known Living-off-the-Land (LotL) binaries (e.g., powershell.exe, certutil.exe, mshta.exe) where the parent or initiating process is the Windows Subsystem for Linux (WSL2) wsl.exe binary. This pattern indicates potential abuse of WSL2 interop features to execute Windows-native binaries from a Linux environment, often used to bypass traditional host-based monitoring or security controls.
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
Detects trusted .NET tooling launching shells, scripting engines, or administrative utilities that are not typically associated with legitimate compilation workflows, potentially indicating malicious execution or post-exploitation.
Page 7 of 45