Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
132
41
32
18
12
Contributors
65
49
41
38
11
Categories
210
128
39
10
9
Platforms
248
2
1
1
Products / Services
97
77
28
20
8
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
2
1
1
1
1
IDS Classtypes
2
IDS Protocols
1
1
Detects the deployment of "Golden Chickens" malware, a method used by the Evilnum APT group. This rule specifically looks for the execution of 'regsvr32.exe' with specific command-line arguments that indicate the registration of an OCX file located in the user's AppData\Roaming directory. This technique is often used for defense evasion and persistence.
This rule detects the creation of potentially suspicious child processes by 'regsvr32.exe'. Regsvr32.exe is a legitimate Windows utility that can be abused by adversaries to proxy execution of malicious code, often referred to as 'Squiblydoo'. The rule specifically looks for regsvr32.exe spawning common Windows utilities or scripting engines like calc.exe, powershell.exe, cmd.exe (implied by net.exe, net1.exe, reg.exe, schtasks.exe), mshta.exe, cscript.exe, and wscript.exe. This behavior is often indicative of defense evasion or execution techniques where regsvr32.exe is used to bypass application whitelisting or security controls.
This rule detects suspicious execution of WMIC (Windows Management Instrumentation Command-line) by Microsoft Office applications. Adversaries often leverage Office applications as an initial execution vector and then use LOLBINs (Living Off the Land Binaries) like WMIC to proxy execution, break parent-child process chains, and evade detection. Specifically, this rule looks for Office processes (Word, Excel, PowerPoint, etc.) spawning `wmic.exe` with command-line arguments indicative of process creation and execution of other suspicious LOLBINs such as `regsvr32`, `rundll32`, `msiexec`, `mshta`, `verclsid`, `wscript`, or `cscript`.
Detects WMIC executing "process call create" with suspicious calls to processes such as "rundll32", "regsrv32", "bitsadmin", "certutil", "cscript", "wscript", "mshta", or commands involving 'cmd.exe' or 'powershell', or paths like 'Users\Public', 'Windows\Temp', 'AppData\Local', and common temporary/program data environment variables. This indicates potential malicious execution or persistence.
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
This rule detects potentially suspicious child processes spawned by PowerShell. It specifically looks for PowerShell (powershell.exe, powershell_ise.exe, pwsh.exe) launching a set of common Windows utilities that can be abused for malicious purposes, such as 'bitsadmin.exe', 'certutil.exe', 'mshta.exe', 'regsvr32.exe', 'rundll32.exe', 'schtasks.exe', and 'wmic.exe'. The rule includes filters to reduce false positives, such as specific command lines for AWS Workspaces, certutil's '-verifystore' option, and common benign wmic queries.
Detects the execution of Living Off The Land Binaries (LOLBINs) from an unusual or abnormal drive, such as a mounted ISO. This behavior can indicate an attempt by an adversary to evade detection by executing legitimate system tools from non-standard locations, often associated with initial access or defense evasion techniques.
Detects potential BlueMushroom DLL loading activity via regsvr32 from the AppData Local directory. This technique is often used for defense evasion and execution of malicious code.
Detects DNS queries initiated by 'Regsvr32.exe'. This activity is suspicious as 'Regsvr32.exe' is a legitimate Windows utility used to register and unregister DLLs, but it is often abused by adversaries for proxy execution, defense evasion, and bypassing application control. A DNS query from this process could indicate an attempt to resolve a malicious domain for command and control or payload retrieval.
Detects suspicious network connections initiated by specific Windows binaries (regsvr32.exe, rundll32.exe, dllhost.exe) when they are executed without any command-line parameters. This behavior can indicate an attempt to evade detection by leveraging legitimate system binaries for malicious network communication, potentially associated with malware like Raspberry Robin.
Detects the creation of suspicious child processes by hh.exe (Microsoft HTML Help). Adversaries often abuse hh.exe to proxy execution of other malicious binaries or scripts, leveraging it as a LOLBIN (Living Off The Land Binary) to bypass defenses. The rule specifically looks for hh.exe launching common system utilities that can be used for malicious purposes, such as CertReq.exe, CertUtil.exe, cmd.exe, cscript.exe, installutil.exe, MSbuild.exe, MSHTA.EXE, msiexec.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, schtasks.exe, wmic.exe, and wscript.exe.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects execution of regsvr32.exe where the DLL being registered or unregistered is located in a potentially suspicious directory such as temporary folders or public user directories. This technique is often used by adversaries for defense evasion and to bypass application whitelisting.
Detects the creation of potentially suspicious child processes by a ClickOnce application. Adversaries may abuse ClickOnce, a Microsoft deployment technology, to execute malicious code or binaries from a trusted source. This rule specifically looks for common Windows utilities and scripting engines being launched as child processes of a ClickOnce application, which could indicate an attempt to bypass security controls or execute further malicious actions.
Detects suspicious child processes spawned by Windows Terminal (WindowsTerminal.exe or wt.exe). This rule identifies the execution of common Living Off The Land Binaries (LOLBins) like rundll32.exe, regsvr32.exe, certutil.exe, cscript.exe, wscript.exe, and csc.exe, as well as processes launched from suspicious user-controlled directories (e.g., Downloads, Desktop, Temp folders). Additionally, it flags command lines containing keywords often associated with malicious activity, such as PowerShell Invoke- and DownloadString, or common command shell execution parameters. This activity could indicate an adversary establishing persistence or executing malicious code via Windows Terminal.
Detects `regsvr32.exe` execution attempting to download and install DLLs from a remote IP address. This technique is often used for defense evasion and bypassing application control by leveraging a trusted Microsoft binary to execute arbitrary code.
Detects the execution of `regsvr32.exe` to load a DLL hosted on a remote network share. This technique is often used by adversaries for defense evasion and to bypass application control.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
Detects the execution of regsvr32.exe with command-line arguments that indicate an attempt to download or register DLLs from remote HTTP or FTP servers. This technique is often used for defense evasion and to bypass application whitelisting by leveraging a legitimate Windows binary to execute malicious code.
This rule detects the execution of `regsvr32.exe` when the DLL it attempts to register or unregister is located in highly suspicious directories. These directories are typically not used for legitimate `regsvr32` operations and can indicate an attempt to evade defenses or execute malicious code from an unusual location. The rule specifically looks for `regsvr32.exe` being executed with a command line that includes paths such as `PerfLogs`, `Temp`, various `Windows\System32` subdirectories not commonly used for DLL registration, and `Windows\SysWOW64` subdirectories, while excluding common legitimate program and system directories.
Detects when the Windows utility 'Regsvr32.exe' initiates an outbound network connection. This behavior can indicate an attempt to bypass application control or execute malicious code by loading remote COM scriptlets or DLLs, often referred to as 'Squiblydoo'.
Page 12 of 12