Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
25
25
9
3
2
Contributors
15
12
10
9
6
Categories
47
34
13
11
5
Platforms
65
1
Products / Services
20
19
16
6
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
IDS Classtypes
2
1
IDS Protocols
3
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility with the "/extract" argument. This method was historically used by malware to extract cabinet files, and while it may still function on older Windows versions, it is generally not a supported or common legitimate use case in modern systems.
Detects potentially suspicious execution of the Regasm or Regsvcs utilities when they are used with command-line arguments containing uncommon file extensions. This behavior can indicate an attempt to bypass application control or execute malicious code through these trusted Windows utilities, often associated with defense evasion techniques.
This rule detects the execution of Regasm.exe or Regsvcs.exe from suspicious directories. Adversaries often abuse these legitimate Windows utilities to proxy execution of malicious code, particularly for defense evasion. By monitoring their execution from uncommon locations like temporary folders or user-writable directories, this rule aims to identify potential malicious activity that leverages these binaries for purposes such as bypassing application control or achieving persistence.
Page 4 of 4