Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the use of regsvr32.exe to execute a remote scriptlet (.sct file) via a URL, a technique often referred to as 'Squiblydoo'. This method bypasses application control by leveraging a trusted Microsoft binary to proxy execution of malicious code.
Detects execution of the Microsoft .NET installer utility (InstallUtil.exe) from non-standard locations. Adversaries often abuse InstallUtil.exe as a proxy to execute malicious code or bypass application control policies, as it is a trusted, digitally signed Microsoft binary. The rule filters out legitimate execution paths typically associated with .NET framework installations, SDKs, or system directories.
Detects the execution of known living-off-the-land binaries (LOLBins) such as mshta.exe, certutil.exe, bitsadmin.exe, wscript.exe, or cscript.exe directly by explorer.exe. This pattern is indicative of a user-initiated execution, potentially triggered by social engineering lures like the 'ClickFix' technique, where a user is tricked into pasting and running malicious commands in the Windows Run dialog or a command prompt context.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
Identifies 'forfiles.exe' being executed with a combination of multiple command-line switches ('/c', '/p', '/m' or their hyphenated equivalents). This pattern can indicate automated scripting or malicious Living-off-the-Land activity, where 'forfiles.exe' is used to execute commands on multiple files or in specific directories.
Detects Odbcconf used for DLL registration as proxy execution technique
Detects the execution of mshta.exe with command-line arguments that include remote protocols (http/https) or scripts (javascript/vbscript). This behavior is commonly associated with fileless malware execution and proxying malicious code via a trusted Windows binary.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launch suspicious child processes often associated with malicious command execution, such as command shells, scripting interpreters, or system utilities.
Detects the execution of known command-line utilities, script interpreters, or installers spawned by web browsers from high-risk directories such as the User Downloads, Temp, or TMP folders. This behavior is indicative of a user downloading and executing malicious files or scripts directly from a web browser.
A detection triggered on endpoint events where common system binaries (e.g., mshta.exe, powershell.exe, cmd.exe) were launched by user-facing parent processes (explorer.exe, chrome.exe, msedge.exe, firefox.exe, iexplore.exe) and executed suspicious command-lines. The pattern matches the evolving technique used in ClickFix-style campaigns whereby malicious pages dynamically place payloads into the clipboard and prompt users to paste or execute them.
This rule detects the creation of suspicious child processes by 'lsass.exe' on Windows systems. LSASS (Local Security Authority Subsystem Service) is a critical Windows process responsible for enforcing security policies. Under normal circumstances, LSASS should not spawn common command-line interpreters or system utilities like cmd.exe, powershell.exe, or rundll32.exe. Such activity is highly indicative of post-exploitation behavior, potentially following a successful compromise like the referenced CVE-2026-41089 Netlogon RCE, where an attacker might use LSASS to execute further commands or tools.
Detects the use of rundll32.exe to execute code via remote URLs, JavaScript, or specific DLL functions known to be abused for proxy execution. This behavior is commonly associated with fileless malware and living-off-the-land techniques to bypass security controls by utilizing legitimate Windows binaries.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects Rundll32 used to execute arbitrary DLL code
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.
Detects the spawning of administrative command-line utilities (cmd.exe, powershell.exe, wscript.exe, certutil.exe, mshta.exe) from processes related to Wyse Management Suite (WMS), Tomcat, or Java. This pattern is often indicative of exploitation of web applications or management services to gain command-line access on the underlying system.
Detects the spawning of administrative command-line utilities (cmd.exe, powershell.exe, wscript.exe, certutil.exe, mshta.exe) from processes related to Wyse Management Suite (WMS), Tomcat, or Java. This pattern is often indicative of exploitation of web applications or management services to gain command-line access on the underlying system.
This rule detects instances where Microsoft Excel (excel.exe) acts as a parent process for suspicious child processes, including command-line interpreters (cmd.exe, powershell.exe), scripting hosts (wscript.exe, cscript.exe, mshta.exe), or binary proxies (rundll32.exe, regsvr32.exe). This pattern is commonly associated with weaponized office documents executing malicious payloads via macros or other embedded scripts.
Page 8 of 45