Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
8
4
3
2
1
Contributors
6
4
2
2
1
Categories
5
5
5
4
3
Platforms
14
3
1
Products / Services
5
4
3
3
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies the creation of a program executable in an unquoted service path, a common technique for privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is 'services.exe'. This activity is significant because unquoted service paths can be exploited by attackers to execute arbitrary code with elevated privileges. If confirmed malicious, this could allow an attacker to gain higher-level access, potentially leading to full system compromise and persistent control over the affected endpoint.
Detects instances where ImageMagick (convert, mogrify, magick, identify) attempts to execute Ghostscript or shell interpreters. The rule flags suspicious behavior such as spawning shell interpreters, using shell metacharacters or pipes in the command line, or executing Ghostscript from non-standard or potentially writable directory paths, which are indicative of a delegate hijack exploitation attempt for arbitrary command execution.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects exploitation of unquoted service paths via SMB file placement
This rule detects an attempt to exploit an unquoted service path vulnerability via an SMB file drop. Specifically, it looks for SMB traffic to port 445 on the home network containing the strings "Program Files" and ".exe" (case-insensitive). This pattern suggests an attacker might be dropping an executable file into a directory within "Program Files" that is part of an unquoted service path, which could lead to arbitrary code execution upon service restart.
Detects the creation, modification, or renaming of the TieringEngineService.exe executable within the System32 directory. This activity is associated with the RedSun exploit (CVE-2026-41091), which leverages Defender remediation redirection to plant a malicious binary. The rule specifically filters out legitimate Windows update operations originating from the WinSxS directory to reduce false positives.
This rule detects the creation of an executable file named 'program.exe' directly in the root of the C:\ drive. This specific file name and location are commonly associated with attempts to exploit unquoted service paths, where an attacker places a malicious executable in a higher-level directory to be executed instead of the legitimate program due to the lack of quotation marks in the service path.
Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes.
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
This detection identifies instances where a Windows service is installed with a file path that contains spaces but is not enclosed in quotation marks. Such misconfigurations can be exploited by attackers for privilege escalation using unquoted service path vulnerabilities. This detection helps administrators identify and remediate potentially insecure service installations.
Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.
The analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. It leverages Endpoint Detection and Response (EDR) data, focusing on specific patterns in process paths. This activity is significant as it can indicate an attempt to bypass security controls and execute unauthorized code. If confirmed malicious, this behavior could lead to code execution, privilege escalation, or persistence within the environment, potentially allowing attackers to deploy malware or leverage other living-off-the-land binaries (LOLBins).
The analytic identifies the creation of a program executable in an unquoted service path, a common technique for privilege escalation. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is 'services.exe'. This activity is significant because unquoted service paths can be exploited by attackers to execute arbitrary code with elevated privileges. If confirmed malicious, this could allow an attacker to gain higher-level access, potentially leading to full system compromise and persistent control over the affected endpoint.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
This rule detects PowerShell scripts that query WMI for service information, specifically looking for the 'Win32_Service' class and requesting 'Name', 'DisplayName', 'PathName', and 'StartMode' properties. This activity is often associated with reconnaissance for unquoted service path vulnerabilities, a common technique used by penetration testers and attackers for privilege escalation.
This rule detects the usage of path traversal techniques within the command line of 'conhost.exe'. This behavior can indicate an attempt to confuse or hijack command arguments, potentially leading to indirect command execution. Specifically, it looks for '/../../' in the command line when 'conhost' is present in the parent command line.
Detects the use of wmic.exe to enumerate service properties (name, displayname, pathname, startmode) which is a common reconnaissance technique used by attackers and pentesters to identify unquoted service paths for potential privilege escalation.