Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the execution of known living-off-the-land binaries (LOLBins) such as mshta.exe, certutil.exe, bitsadmin.exe, wscript.exe, or cscript.exe directly by explorer.exe. This pattern is indicative of a user-initiated execution, potentially triggered by social engineering lures like the 'ClickFix' technique, where a user is tricked into pasting and running malicious commands in the Windows Run dialog or a command prompt context.
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects execution of the Microsoft .NET installer utility (InstallUtil.exe) from non-standard locations. Adversaries often abuse InstallUtil.exe as a proxy to execute malicious code or bypass application control policies, as it is a trusted, digitally signed Microsoft binary. The rule filters out legitimate execution paths typically associated with .NET framework installations, SDKs, or system directories.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects the use of rundll32.exe to execute code via remote URLs, JavaScript, or specific DLL functions known to be abused for proxy execution. This behavior is commonly associated with fileless malware and living-off-the-land techniques to bypass security controls by utilizing legitimate Windows binaries.
This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.
Detects suspicious installations of ManageEngine Endpoint Central components (ManageEngineADSelfService.exe or me_servicelaunchpad.exe) when executed with silent installation parameters or initiated by scripting engines (wscript.exe, cscript.exe, powershell.exe), followed by the execution of 'reg.exe' or 'regsvcs.exe' within a two-hour window. This pattern can indicate an attempt to install or configure the software surreptitiously, potentially for persistence or privilege escalation.
Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk.
This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.
This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.
Detects LOLBINs and applications that should not legitimately drop script files to disk.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.
Detects instances where the Windows Event Viewer utility (eventvwr.exe) spawns a child process other than the Microsoft Management Console (mmc.exe). This behavior is a well-documented technique for bypassing User Account Control (UAC) because eventvwr.exe is an auto-elevating binary, which can be manipulated to execute arbitrary payloads with high-integrity privileges.
Detects the native ClickOnce service host (dfsvc.exe) spawning interactive command shells, a direct indicator of exploitation.
Detects the use of 'forfiles.exe' with the '/c' execution parameter, a technique that can be abused to launch arbitrary commands while potentially bypassing application controls. This activity is often associated with defense evasion tactics.
Detects the use of regsvr32.exe to execute a remote scriptlet (.sct file) via a URL, a technique often referred to as 'Squiblydoo'. This method bypasses application control by leveraging a trusted Microsoft binary to proxy execution of malicious code.
Detects execution of ConfigurationRemotingServer.exe as a child process of winget.exe. This activity is indicative of the DSCourier technique, which abuses the Windows Package Manager Desired State Configuration (DSC) engine to execute arbitrary PowerShell scripts embedded in configuration files, bypassing standard PowerShell invocation monitoring.
Detects instances where the 'ConfigurationRemotingServer.exe' binary is spawned by 'WindowsPackageManagerServer.exe' without 'winget.exe' being the parent process. This behavior suggests direct interaction with the WinGet DSC COM API by a non-standard client, which may be an attempt to execute arbitrary code or bypass security constraints typically enforced when using the official winget client.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Page 9 of 45