Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.
This rule monitors process creation events for suspicious activity, specifically detecting two patterns: 1) The creation of a scheduled task named 'OneDrive KeepAlive' using schtasks.exe, which is indicative of persistence mechanisms masquerading as legitimate software, and 2) Execution of the 'taskhostw.exe' binary with command-line arguments 'exec' and 'hide', which is a common indicator of the NirCmd utility being renamed and used for stealthy execution.
Detects the execution of the Windows binary InstallUtil.exe using specific flags (/logfile=, /LogToConsole=false, and /U) commonly used to execute arbitrary .NET code while bypassing application control mechanisms such as AppLocker or Windows Defender Application Control (WDAC).
Detects the execution of regsvr32.exe with flags indicative of the Squiblydoo technique, which utilizes the /i parameter to load a remote COM scriptlet (.sct file) via scrobj.dll. This method is a known application allowlisting bypass technique.
Detects the execution of odbcconf.exe with the REGSVR action. This technique leverages the legitimate Windows utility odbcconf.exe to load and execute arbitrary DLLs, bypassing security controls that might not monitor or restrict this binary.
Detects the execution of cmstp.exe with silent (/s) and auto-install (/au) flags pointing to an attacker-supplied INF file. This pattern is a documented technique for bypassing User Account Control (UAC) and performing signed-binary proxy execution to load malicious payloads.
Detects the execution of Control Panel (.cpl) files via control.exe from non-standard system directories, or the use of rundll32.exe to invoke CPL applets. These methods are commonly used to proxy malicious code execution while appearing legitimate.
Detects the abuse of the legitimate Windows script 'SyncAppvPublishingServer.vbs' to proxy the execution of malicious commands, specifically by appending an arbitrary command separated by a semicolon.
Detects the execution of the Program Compatibility Assistant (pcalua.exe) with the '-a' flag to launch executables located in common user-writable directories such as Temp, Downloads, or AppData. This behavior is a known Living off the Land Binaries and Scripts (LOLBAS) technique used to proxy execution and potentially bypass security controls or break parent-child process lineage.
Detects the execution of cmd.exe with suspicious command-line obfuscation patterns. The rule looks for the use of the '/k' flag combined with variable assignment and character substitution/expansion patterns (e.g., %var:~start,len%), often used in batch file obfuscation to execute malicious logic. It specifically triggers when originating from common suspicious parents like explorer.exe or Bandizip.exe, or when targeting syswow64 locations.
Detects the use of odbcconf.exe with the REGSVR flag to load DLLs from suspicious directory locations (such as Temp, Downloads, or AppData), a technique used by adversaries to proxy execution and bypass application control.
Detects the execution of installutil.exe with specific command-line arguments (logging disabled, uninstall flag) from file paths outside of the standard .NET directory structure. This pattern is commonly used by attackers to proxy execution of arbitrary managed code, effectively bypassing application whitelisting and security controls.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects file creation, renaming, or deletion events within the Recycle Bin directory involving suspicious filenames or PDF files, which may indicate an adversary attempting to hide, stage, or delete evidence.
Detects the execution of regasm.exe or regsvcs.exe where the command line arguments reference paths typically used for temporary files, user downloads, or public directories. These signed .NET utilities can be abused to proxy the execution of malicious code by loading custom COM assemblies via ComRegisterFunction or ComUnregisterFunction attributes, effectively bypassing application control.
Detects execution of MSBuild.exe (Microsoft Build Engine) where the project file is located in a potentially user-writable, temporary, or staging directory, or when the command line includes indicators of inline task compilation (e.g., UsingTask or TaskFactory). This behavior is often associated with the use of MSBuild to proxy execution of arbitrary code to bypass application control mechanisms.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
Detects emails containing a RAR attachment combined with a shortened URL. This combination is a common technique used in phishing campaigns to deliver malicious payloads while attempting to evade security filters.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
This rule detects instances where the DISM core library (DismCore.dll) is loaded by a process named 'index.exe', or where a process named 'index.exe' is executing from or interacting with a folder path containing 'DISM'. This behavior is characteristic of malicious tools or scripts attempting to proxy execution through the Deployment Image Servicing and Management (DISM) binary, a common technique for bypassing security controls.
Detects components of the LucidPawn malware family using DLL side-loading (e.g., index.exe loading DismCore.dll) or renaming DISM binaries within WindowsApps folders. The detection identifies these processes subsequently querying system locale or language registry keys, indicating a geo-targeting execution gate used to determine if the environment matches the intended target profile (specifically zh-TW).
Page 115 of 864