Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
This rule detects suspicious activity associated with the 'MixedSvc' service and potential DLL side-loading. It identifies the creation of a Windows service named 'MixedSvc' using sc.exe, the execution of 'Mixed Reality.exe' from a Windows Media Player directory, the side-loading of 'nvdaHelperRemote.dll' within the Windows Media Player directory, and the execution of svchost.exe with 'Mixed Reality.exe' as its parent/causality actor, which is indicative of malicious injection and persistence mechanisms.
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
Detects the use of 7-Zip (7z.exe) executed via the command-line interpreter (cmd.exe) to interact with a specific data file named 'data.dat' associated with the 'Traiolx Custom Utils' project, which may indicate data staging or archival activities performed by an adversary.
Detects potential UAC bypass attempts using COM surrogate (dllhost.exe) or MMC (mmc.exe) to spawn child processes from suspicious or user-writable locations like AppData or Temp. It also monitors for specific command-line artifacts associated with BeepRAT and other potentially malicious activity.
Detects the execution of the 'whoami' command via cmd.exe initiated with High integrity. This behavior is often associated with discovery efforts by adversaries operating with elevated privileges to identify the current user context.
Detects evidence of malware, specifically TA4922 (Atlas RAT, RomulusLoader), attempting to evade sandbox or virtualization environments. The detection monitors process command lines for WMI queries or registry artifact paths related to known hypervisor technologies such as VMware, VirtualBox, and QEMU. It requires multiple occurrences within a 5-minute window to reduce potential noise.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) spawns a command shell (cmd.exe) with command-line arguments involving standard output redirection (2>&1), often used to capture error and output streams in remote command execution scenarios. This pattern is commonly observed during lateral movement or remote administration activity.
Detects the abuse of the Windows Package Manager (WinGet) Desired State Configuration (DSC) engine, specifically via the 'ConfigurationRemotingServer.exe' process. Adversaries may leverage this mechanism to execute embedded PowerShell scripts with elevated privileges, bypassing standard execution contexts by abusing the legitimate package management infrastructure. The rule tracks the lifecycle of this abuse, from initial activation via 'winget.exe' or 'WindowsPackageManagerServer.exe' to the final execution of PowerShell or other shells by the configuration server.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects the deletion or renaming of .jse (JScript Encoded) files by the Windows script hosts wscript.exe or cscript.exe. This activity is often associated with the cleanup of obfuscated scripts after they have been executed as part of a malicious campaign.
Detects the use of the built-in Windows rundll32.exe utility to call the MiniDump function within comsvcs.dll, a known technique for dumping the memory contents of the Local Security Authority Subsystem Service (LSASS). The rule specifically flags executions that write to the Windows\Temp directory, which is a common indicator of unauthorized credential harvesting attempts.
Detects instances where the Ghidra software suite (via analyzeHeadless or ghidraRun) or its associated Java runtime initiates unexpected child processes, such as common system utilities (e.g., cmd.exe, powershell.exe, calc.exe) or executes scripts from untrusted locations like Temp, Downloads, or network shares. This behavior is indicative of potential exploitation attempts, such as arbitrary code execution triggered by a malicious project or script import.
Detects instances of PowerShell executing Base64-encoded commands initiated by Windows Explorer, a common technique used in the Potemkin Loader/ClickFix campaign to evade static analysis and security controls.
Detects execution of PowerShell processes (powershell.exe, pwsh.exe) containing command-line arguments indicative of Antimalware Scan Interface (AMSI) bypass attempts. This includes known bypass strings, reflection-based patching of memory internals (AmsiUtils, GetDelegateForFunctionPointer), and base64-encoded fragments of common bypass techniques.
This rule detects potential persistence mechanisms associated with Microsoft Outlook, specifically targeting registry modifications related to Outlook security settings or suspicious child processes (cmd.exe or powershell.exe) spawned by outlook.exe.
Detects the use of WMI (via WmiPrvSE.exe or wmic.exe) to enumerate or terminate PowerShell processes. This behavior is indicative of the Amadey/StealC delivery chain, where a JScript dropper uses WMI to clean up script execution artifacts after a specified timeout, aiding in defense evasion.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the use of the 'netsh trace' command to initiate network packet capture, executed via cmd.exe or powershell.exe. This activity is a known technique used by The Gentlemen RaaS group to perform credential harvesting from unencrypted internal network traffic by saving packet capture files to administrative shares.
Detects the creation of scheduled tasks by known Mustang Panda DLL sideloading hosts, specifically Solid PDF Creator or Citrix Receiver components. This rule identifies persistence mechanisms likely established during the post-compromise phase of espionage operations.
Detects suspicious modifications to Group Policy Objects (GPOs) using PowerShell cmdlets, including references to sensitive paths like SYSVOL/NETLOGON or suspicious script files, as well as the execution of 'gpupdate /force' from non-standard shell processes. These behaviors are often indicative of GPO abuse for persistence, lateral movement, or defense evasion.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Page 17 of 29