Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
Detects the use of the PhoneDeepLink parameter with DeviceEnroller.exe to potentially sideload a non-existent DLL file named "ShellChromeAPI.dll". Adversaries can leverage this technique by dropping their own renamed malicious DLL and executing it via DeviceEnroller.exe using this parameter.
Detects an anomalous execution of 'dllhost.exe' where the process spawns without any command-line arguments. This behavior is highly unusual for legitimate 'dllhost.exe' processes and can indicate malicious activity such as process injection or malware attempting to masquerade as a legitimate system process.
Detects the execution of the DInjector PowerShell cradle, identified by specific command-line arguments '/am51' and '/password'. This tool is often used for process injection and privilege escalation.
This rule detects the use of 'pnputil.exe' to install or add drivers on a Windows system. Adversaries may use this utility to install malicious or vulnerable drivers for privilege escalation, persistence, or to bypass security controls. The detection specifically looks for command-line arguments indicative of driver installation, such as '-i', '/install', '-a', '/add-driver', and the presence of '.inf' in the command line.
Detects the suspicious execution of 'grpconv.exe' with the '-o' flag, which can be used to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors. This command-line usage is uncommon in legitimate environments and may indicate an attempt to establish persistence or escalate privileges.
This rule detects potential DLL injection or execution attempts using 'Tracker.exe', a legitimate Microsoft binary that can be abused. The detection specifically looks for 'Tracker.exe' being executed with command-line arguments '/d' or '/c', which are indicative of its use in loading or executing DLLs. It filters out common false positives related to MSBuild processes.
Detects potential DLL sideloading of "mpclient.dll" by legitimate Windows Defender processes ("MpCmdRun.exe" and "NisSrv.exe") when they are executed from a non-standard directory. This technique can be used by adversaries to execute malicious code under the guise of a trusted process, potentially leading to privilege escalation, persistence, or defense evasion.
Detects direct modification of autostart extensibility point (ASEP) in the Windows Registry using the `reg.exe` utility. This rule specifically looks for the 'add' command within `reg.exe` command lines targeting common Run keys and other autostart locations.
This rule detects the execution of 'runonce.exe' with specific command-line arguments, indicating the execution of a Run Once task as configured in the registry. This is a common method for persistence and defense evasion on Windows systems.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a file from the 'C:\Users\<USER>\AppData\Local' directory. This behavior is often indicative of malware establishing persistence or privilege escalation, as the AppData\Local folder is a common location for user-specific application data and can be written to without administrative privileges. The rule specifically looks for tasks created to run under 'NT AUTHORITY\SYSTEM' or 'SYSTEM' accounts, which would grant elevated privileges to the executed payload.
This rule detects the creation of scheduled tasks using 'schtasks.exe' where the command line includes common scripting interpreters (powershell, pwsh, cmd) and specifies a suspicious folder path like 'C:\ProgramData\' or '%ProgramData%'. This combination is often used by adversaries for persistence or privilege escalation by scheduling malicious code to run from a location typically used for application data, which can be less monitored than system directories.
Detects the creation or modification of scheduled tasks using `schtasks.exe` with suspicious schedule types such as 'ONLOGON', 'ONSTART', 'ONCE', or 'ONIDLE'. This rule specifically filters out common legitimate system accounts like 'NT AUTHORITY\SYSTEM' and 'SYSTEM' and the 'HIGHEST' privilege setting to reduce false positives.
Detects the creation of a scheduled task using 'schtasks.exe' that is configured to execute a PowerShell command. The PowerShell command specifically attempts to retrieve a base64 encoded payload from the Windows Registry (HKCU or HKLM hive) and execute it. This technique is often used by adversaries for persistence and to evade detection by obfuscating the malicious payload.
Detects the creation or modification of scheduled tasks using 'schtasks.exe' that are configured to run with high privileges (NT AUTHORITY\SYSTEM, SYSTEM, or HIGHEST) and utilize suspicious schedule types such as ONLOGON, ONSTART, ONCE, or ONIDLE. This combination is often indicative of persistence or privilege escalation attempts by adversaries.
Detects the Windows Installer service (msiexec.exe) attempting to install MSI packages with SYSTEM privileges, which can be indicative of privilege escalation through the 'AlwaysInstallElevated' policy.
This rule detects attempts to write or modify files within the `C:\Windows\System32\Tasks\` or `C:\Windows\SysWow64\Tasks\` directories using common command-line utilities. Adversaries may leverage the globally writable nature of these folders to achieve privilege escalation, persistence, or defense evasion by loading custom assemblies or scripts into legitimate Windows processes like cscript, wscript, regsvr32, mshta, or eventvwr.
Detects the creation of a process where the parent process is 'EdgeTransport.exe' and the child process is not 'conhost.exe' or 'OleConverter.exe'. This behavior is indicative of a WMI backdoor being used in Exchange Transport Agents, leveraging WMI event filters for persistence or execution.
Detects the execution of the Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused to side-load a custom version of "xwizards.dll", which can be used for privilege escalation, persistence, or defense evasion.
This rule detects modifications to the 'Run Once' registry key, specifically targeting the 'StubPath' value within 'Microsoft\Active Setup\Installed Components'. This registry key is often used by legitimate applications for one-time execution tasks, but adversaries can abuse it to establish persistence or execute malicious payloads. The rule includes filters to exclude common legitimate modifications made by Google Chrome and Microsoft Edge installers, which frequently use this mechanism.
Page 262 of 401