Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
89
32
9
5
4
Contributors
42
39
20
10
8
Categories
80
53
26
17
15
Platforms
144
1
1
Products / Services
51
27
25
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
IDS Classtypes
1
IDS Protocols
1
Detects the creation of an NTFS Alternate Data Stream named :WDFOO in temporary staging directories, often associated with wermgr.exe and subsequent Windows Defender scans. This behavior is indicative of a TOCTOU (Time-of-Check Time-of-Use) exploitation chain, specifically linked to the RoguePlanet exploit targeting CVE-2026-50656, where EICAR test strings are used to manipulate anti-virus detection flows.
This rule detects activities indicative of the RoguePlanet exploit, which utilizes NTFS junction swapping to stage malicious operations. It monitors for the creation of suspicious system-like directories within temporary paths, writing of executables (like wermgr.exe) to those paths, unprivileged manipulation of the Windows Defender Quarantine directory, and virtual disk image mounting from user-writable directories.
Detects the creation of shortcut (.lnk) files in the Windows Startup directory by common archive extraction utilities, indicative of the Gamaredon/UAC-0226 GIFTEDCROOK campaign using CVE-2025-8088 to perform path traversal and gain persistence.
This rule detects the creation of files with NTFS Alternate Data Streams (ADS). Adversaries often use ADS to hide malicious payloads or tools within the file metadata of legitimate-looking files to evade static analysis and security monitoring.
Detects malicious activity related to the 'RoguePlanet' exploit (referencing CVE-2026-50656) which involves manipulating NTFS junctions to redirect system file operations. The rule monitors for specific staging directory patterns (RP_<UUID>), the creation of named pipes associated with RoguePlanet, and the execution of suspicious binaries or staging of files in system paths.
Detects exploitation activity associated with CVE-2025-8088 used by UAC-0226 (GIFTEDCROOK). The rule monitors for WinRAR-family archive tools dropping files into the startup folder, staging payloads into C:\ProgramData, and the subsequent logon execution chain where cmd.exe launches PowerShell to execute encoded commands or content from ProgramData.
Detects WinRAR.exe writing files to sensitive directories such as the Startup folder or C:\ProgramData, potentially indicative of exploitation of path traversal vulnerabilities (CVE-2025-8088, CVE-2025-6218). This activity is associated with UAC-0226's use of WinRAR to establish persistence or stage malicious payloads.
Detects WinRAR application writing a shortcut (.lnk) file directly into the Windows Startup folder. This activity is indicative of exploitation of NTFS Alternate Data Stream (ADS) path traversal vulnerabilities (such as CVE-2025-8088 or CVE-2025-6218) to achieve persistence by placing a malicious shortcut in the user's startup directory without triggering typical user interaction warnings.
Detects the creation of an NTFS Alternate Data Stream (ADS) named :WDFOO on the wermgr.exe process within RP_* staged directories. This behavior is a specific indicator of the RoguePlanet exploit (CVE-2026-50656), which leverages an ADS write to trigger a Microsoft Defender on-access scan and facilitate a TOCTOU (Time-of-Check to Time-of-Use) race condition for privilege escalation or exploitation.
Detects the WinRAR.exe process creating a .lnk shortcut file within the user's Startup directory. This behavior is indicative of an exploitation attempt (e.g., UAC-0226 related NTFS path traversal vulnerabilities) where an attacker plants a persistence mechanism via a malicious archive extraction.
Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
Detects the use of NTFS Alternate Data Streams (ADS) by monitoring process command lines, initiating process command lines, and folder paths for patterns indicative of ADS notation. The rule specifically flags potential execution or access patterns involving common script interpreters (wscript, cscript, powershell, pwsh) combined with ADS, as well as general ADS usage in file paths.
This rule detects the creation of NTFS reparse points or junctions within temporary directory paths, often used by adversaries to bypass directory access controls or redirect file system operations. The rule identifies file creation activities occurring under paths matching a specific temporary folder pattern (RP_ followed by a hex string) and excludes legitimate system operations like wermgr.exe executions.
Detects suspicious access to wermgr.exe involving Alternate Data Streams (ADS) using the WDFOO tag, or access via Volume Shadow Copy (VSS) paths, often indicative of exploitation attempts related to CVE-2026-50656 where an adversary uses oplocks for race conditions against Windows Defender.
Detects the creation, reading, or execution of payloads stored within NTFS Alternate Data Streams (ADS). This technique is commonly used by adversaries to hide malicious content within file metadata to evade security tools. The rule monitors process command-line arguments for ADS syntax, identifies usage of utilities like type, Get-Content, wmic, or various LOLBins (e.g., regsvr32, rundll32) interacting with ADS paths, and flags anomalous file creation/modification events that involve ADS, excluding known system-generated streams.
Detects the creation, reading, or execution of payloads stored within NTFS Alternate Data Streams (ADS). This technique is commonly used by adversaries to hide malicious content within file metadata to evade security tools. The rule monitors process command-line arguments for ADS syntax, identifies usage of utilities like type, Get-Content, wmic, or various LOLBins (e.g., regsvr32, rundll32) interacting with ADS paths, and flags anomalous file creation/modification events that involve ADS, excluding known system-generated streams.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
This rule detects the creation of suspicious NTFS Alternate Data Streams (ADS) commonly associated with malicious activities. Specifically, it monitors for the use of the ':WDFOO' stream name within temporary directories, which is a known indicator of certain malware or post-exploitation staging behaviors. Additionally, it identifies attempts by 'wermgr.exe' (Windows Error Reporting Manager) to interact with temporary files in these paths, which may suggest masquerading or living-off-the-land techniques.
Page 2 of 7