Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
74 detections
Filters
Last updated
All Time
Detection languages
30
26
7
4
3
Contributors
18
15
6
6
5
Categories
33
20
15
12
11
Platforms
72
2
Products / Services
22
22
10
10
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
5
3
2
1
1
IDS Classtypes
1
IDS Protocols
1
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects the extraction of executable, script, or macro-enabled files from archives using 7-Zip utilities. This behavior is notable because 7-Zip often fails to propagate the Mark-of-the-Web (MotW) Zone.Identifier Alternate Data Stream (ADS) to extracted files, which can bypass Windows SmartScreen and security zone protections upon subsequent execution of the extracted files.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
Detects high-risk child processes spawned by 7-Zip (7z.exe, 7zG.exe, 7zFM.exe) when extracting files. This rule is designed to identify potential exploitation of CVE-2026-46331, where 7-Zip fails to properly propagate the Zone.Identifier alternate data stream (Mark-of-the-Web) from RAR5 archives, effectively bypassing SmartScreen security warnings for extracted executables or scripts.
Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
Detects scenarios where 7-Zip (7z.exe or 7zG.exe) extracts an executable file to a user-writable directory (such as Downloads, Temp, or AppData), potentially stripping the Mark-of-the-Web (MOTW) identifier. The rule specifically tracks instances where such an extracted file is subsequently launched by the shell or Windows explorer within 5 minutes of extraction.
Maps the behavioral sequence of a user mounting an ISO/IMG file (which bypasses MOTW) and subsequently executing a payload originating from the new virtual drive.
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
This rule detects attempts to bypass the Mark-of-the-Web (MOTW) security feature by removing or altering the Zone.Identifier stream from downloaded files. Specifically, it looks for HTTP traffic (flow:to_client,established) containing both 'Zone.Identifier' and 'ZoneId=3' (which typically indicates an internet zone download) in the file data, suggesting an attempt to strip this metadata during transit to prevent security warnings or restrictions on the client side. This technique is often used by attackers to make malicious files appear less suspicious.
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.
Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Detects the execution of script interpreters (wscript.exe, cscript.exe, cmd.exe, powershell.exe) where the script file being executed resides on a newly mounted virtual disk volume (VHD, ISO, etc.).
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
Detects PowerShell using the Unblock-File cmdlet to remove the Mark-of-the-Web (MotW) from a file located in the C:\ProgramData directory. This technique was observed in an APT36 campaign to allow a staged payload to execute without triggering Windows security warnings.
Page 2 of 4