Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
15
14
9
9
4
Contributors
16
9
8
7
3
Categories
33
30
7
6
5
Platforms
50
1
1
1
Products / Services
26
19
16
7
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
1
IDS Protocols
4
The following analytic detects the execution of native .NET binaries from non-standard directories within the Windows operating system.
It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
The following analytic detects the execution of InstallUtil.exe from non-standard paths. It leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names outside typical directories. This activity is significant because InstallUtil.exe is often used by attackers to execute malicious code or scripts. If confirmed malicious, this behavior could allow an attacker to bypass security controls, execute arbitrary code, and potentially gain unauthorized access or persist within the environment.
The following analytic detects the use of the Windows InstallUtil.exe binary with the `/u` (uninstall) switch, which can execute code while bypassing application control. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because it can indicate an attempt to execute malicious code without administrative privileges. If confirmed malicious, an attacker could achieve code execution, potentially leading to further system compromise or persistence within the environment.
Detects execution of the Microsoft .NET utility InstallUtil.exe with command-line arguments typically used to execute arbitrary code or bypass application whitelisting. The rule monitors for common bypass switches such as /logfile, /LogToConsole=false, or /U, while filtering out executions from standard Windows directories to identify potential malicious usage of this signed binary proxy.
Detects the execution of Microsoft-signed .NET utilities (RegSvcs, InstallUtil, MSBuild, CSC, VBC, ILAsm, AspNet_Compiler) when spawned by scripting engines like PowerShell, wscript, or cscript. This behavior is indicative of the Veil#Drop framework using trusted developer utilities as a fallback mechanism to execute secondary payloads or bypass security controls.
Detects the execution of the Windows binary InstallUtil.exe using specific flags (/logfile=, /LogToConsole=false, and /U) commonly used to execute arbitrary .NET code while bypassing application control mechanisms such as AppLocker or Windows Defender Application Control (WDAC).
Detects the execution of installutil.exe with specific command-line arguments (logging disabled, uninstall flag) from file paths outside of the standard .NET directory structure. This pattern is commonly used by attackers to proxy execution of arbitrary managed code, effectively bypassing application whitelisting and security controls.
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
This rule detects potential misuse of the legitimate Windows utility InstallUtil.exe (a .NET component installer) to proxy the execution of malicious code. It identifies two specific suspicious patterns: first, the execution of InstallUtil with command-line arguments indicative of bypass attempts (e.g., /logfile, /LogToConsole, or /U) or loading files from user-writable directories (Temp, AppData, Downloads, ProgramData); second, instances where InstallUtil spawns potentially malicious child processes such as PowerShell, cmd, or various system binaries often used for persistence or lateral movement.
This rule detects potential misuse of the legitimate Windows utility 'InstallUtil.exe' for proxy execution. It flags instances where InstallUtil is executed with suspicious command-line parameters often used for bypass techniques (e.g., logging flags or loading code from user-writable directories like Temp, AppData, or Downloads), or when InstallUtil acts as a parent process to suspicious child processes typically associated with post-exploitation activities.
This rule detects potential misuse of the legitimate Windows utility InstallUtil.exe (a .NET component installer) to proxy the execution of malicious code. It identifies two specific suspicious patterns: first, the execution of InstallUtil with command-line arguments indicative of bypass attempts (e.g., /logfile, /LogToConsole, or /U) or loading files from user-writable directories (Temp, AppData, Downloads, ProgramData); second, instances where InstallUtil spawns potentially malicious child processes such as PowerShell, cmd, or various system binaries often used for persistence or lateral movement.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects execution of the Microsoft .NET installer utility (InstallUtil.exe) from non-standard locations. Adversaries often abuse InstallUtil.exe as a proxy to execute malicious code or bypass application control policies, as it is a trusted, digitally signed Microsoft binary. The rule filters out legitimate execution paths typically associated with .NET framework installations, SDKs, or system directories.
Detects execution of the Microsoft InstallUtil.exe utility with suspicious command-line arguments (logging suppressed to file and console) where the binary is unsigned. This is a common technique used by adversaries to proxy execution of arbitrary .NET code while attempting to avoid detection and maintain stealth.
Detects suspicious network activity originating from the InstallUtil.exe process. InstallUtil is a legitimate Windows .NET utility that can be abused as a LOLBin (Living-off-the-Land Binary) to proxy the execution of malicious payloads, potentially bypassing application control mechanisms.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects execution of the Microsoft InstallUtil.exe utility with suspicious command-line arguments (logging suppressed to file and console) where the binary is unsigned. This is a common technique used by adversaries to proxy execution of arbitrary .NET code while attempting to avoid detection and maintain stealth.
Detects execution of the Microsoft .NET installer utility (InstallUtil.exe) from non-standard locations. Adversaries often abuse InstallUtil.exe as a proxy to execute malicious code or bypass application control policies, as it is a trusted, digitally signed Microsoft binary. The rule filters out legitimate execution paths typically associated with .NET framework installations, SDKs, or system directories.
Detects execution of the Microsoft .NET Framework InstallUtil.exe utility when it is invoked to load a file from suspicious user-writable directories (such as AppData, Temp, Downloads, or Desktop). This activity is indicative of potential proxy execution of malicious code, a technique often used to bypass application whitelisting.
Detects suspicious process injection attempts where common scripting/execution binaries (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are observed creating remote threads in other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe). The detection is further refined by looking for specific keywords in the initiating process's command line that are indicative of malicious activity, such as downloading content or executing scripts. This rule aims to identify advanced persistent threats and malware leveraging process injection for defense evasion and privilege escalation.
Detects suspicious network activity originating from the InstallUtil.exe process. InstallUtil is a legitimate Windows .NET utility that can be abused as a LOLBin (Living-off-the-Land Binary) to proxy the execution of malicious payloads, potentially bypassing application control mechanisms.
Page 1 of 3