Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
49 detections
Filters
Last updated
All Time
Detection languages
27
11
5
2
2
Contributors
16
9
6
3
3
Categories
20
10
8
7
7
Platforms
47
2
1
Products / Services
24
7
6
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
3
2
2
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the suspicious initiation of Control Panel applet functionality via the COM object 'COpenControlPanel'. Adversaries may leverage this COM interface or the associated 'CPL_INIT' message to proxy malicious code execution through standard Windows processes like dllhost.exe or rundll32.exe, effectively bypassing security controls that might otherwise flag the direct execution of malicious .cpl files.
Detects instances where the WindowsPackageManagerServer.exe (WinGet COM Server) is invoked to perform DSC (Desired State Configuration) operations (via ConfigurationStaticFunctions) by a process other than the standard winget.exe. This behavior is indicative of an attempt to bypass process-based monitoring of winget.exe by interacting directly with the COM API using custom or alternative tools like DSCourier.exe.
Detects the dllhost.exe process, running with SYSTEM privileges, loading a dynamic link library (DLL) from a user-writable path within the ProgramData directory. This behavior is consistent with the abuse of COM marshaling, specifically exploiting dangling CLSID entries to force a privileged COM host process to unmarshal and load an attacker-controlled DLL.
This rule monitors for suspicious activity related to Component Object Model (COM) objects, including registry modifications (creation, setting, or checking of specific CLSIDs related to shell links or WMI locators) in conjunction with process-level alerts (such as Remote Thread API calls, primary token modification, or WMI activity). It specifically filters out known benign system processes to focus on anomalous behavior that may indicate COM hijacking, persistence, or lateral movement.
Detects unauthorized modifications to the InprocServer32 registry key for the specific CLSID {2155fee3-2419-4373-b102-6843707eb41f}, a technique used by malware to achieve persistence by hijacking COM object instantiation to load a malicious DLL.
Detects command-line execution patterns involving the instantiation of potentially malicious COM objects (such as ADODB.Stream, Shell.Application, or network-related objects) using WScript.CreateObject or ActiveXObject. This pattern is commonly used in malicious JScript/VBScript to facilitate file operations, command execution, or network communication.
Detects the creation of or connection to the specific named pipe '\\pipe\\RoguePlanet', which is used as a synchronization and callback channel by the Nightmare Eclipse RoguePlanet exploit (CVE-2026-50656). This exploit leverages the named pipe to facilitate communication between a low-privileged exploit process and a SYSTEM-level Windows Error Reporting (WER) task payload during a local privilege escalation attempt.
Detects the creation of the named pipe '\pipe\RoguePlanet', which is specifically utilized by the RoguePlanet CVE-2026-50656 exploit. The exploit uses this pipe for synchronization during a TOCTOU race condition against MsMpEng.exe. Once the race is won, a SYSTEM-level payload (typically masquerading as a child process of wermgr.exe) uses this pipe to verify the originating session and subsequently spawn an interactive shell as NT AUTHORITY\SYSTEM. This pipe name is unique to this exploit and not used by legitimate software.
Detects unauthorized child process creation by the Windows Error Reporting Manager (wermgr.exe). The rule identifies scenarios where wermgr.exe, executed under the SYSTEM context via the QueueReporting scheduled task (often abused in the RoguePlanet exploit chain), spawns interactive shells or command processors like cmd.exe, powershell.exe, or cscript.exe. Legitimate instances of wermgr.exe do not spawn interactive user interfaces or shells.
Detects registry access attempts to the CLSID registration entries for Chrome, Brave, and Edge IElevator COM interfaces. These interfaces are designed for browser-internal maintenance tasks. Adversaries, such as the operators of WEES Stealer, abuse these interfaces by invoking the IElevator DecryptData method via out-of-process COM activation to decrypt App-Bound encryption keys, bypassing standard browser security boundaries.
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects potential DCOM lateral movement where 'mmc.exe', 'wmiprvse.exe', 'excel.exe', or 'dllhost.exe' are spawned with the '-Embedding' flag by 'svchost.exe' under the 'DcomLaunch' or 'RPCSS' services. This indicates that RPCSS performed a HKCR\CLSID registry lookup and activated a COM server object on the host, which can be abused for remote code execution.
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
This rule detects potential local privilege escalation attempts targeting the AnyDesk printer service. The rule monitors for unauthorized COM server registration (COM hijacking) and the subsequent spawning of suspicious child processes (e.g., cmd.exe, PowerShell) directly linked to the AnyDesk process tree. This behavior is indicative of exploiting the AnyDesk COM object printer impersonation vulnerability to gain NT AUTHORITY\SYSTEM privileges.
Identifies MSHTA executing embedded VBScript that suppresses its window while instantiating the Shell.Application COM object to launch subsequent scripts.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Page 1 of 3