Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
1
1
1
Contributors
3
2
1
Categories
4
3
2
1
1
Platforms
5
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects Verclsid used for COM object verification as proxy execution
This rule detects HTTP requests containing 'verclsid' and '/S' in the URI, which is indicative of the Verclsid COM Object Proxy Execution technique (T1218.012). This technique is often used by attackers for defense evasion by executing arbitrary commands or binaries through a COM object.
Detects when 'verclsid.exe', a legitimate Windows binary, is used to execute a COM object via its GUID. This technique is often leveraged by adversaries for defense evasion and to bypass application control mechanisms by proxying execution through a trusted system binary.
The following analytic detects the potential abuse of the verclsid.exe utility to execute malicious files via generated CLSIDs. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific command-line patterns associated with verclsid.exe. This activity is significant because verclsid.exe is a legitimate Windows application used to verify CLSID COM objects, and its misuse can indicate an attempt to bypass security controls. If confirmed malicious, this technique could allow an attacker to execute arbitrary code, potentially leading to system compromise or further malicious activities.
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.