Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
601 detections
Filters
Last updated
All Time
Detection languages
174
118
116
79
47
Contributors
276
114
54
37
34
Categories
500
372
135
97
57
Platforms
586
24
11
5
3
Products / Services
10,665
9,773
6,705
4,421
3,749
601
MITRE Techniques
369
186
148
142
91
CVEs
6
3
3
2
2
Detects the creation of scheduled tasks that contain indicators related to QEMU virtualization software (e.g., binaries, disk images) or tasks created by web server processes. This behavior is often associated with adversary attempts to establish persistence, hide malicious activity within VM environments, or execute payloads following exploitation of a web application.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects anomalous frequency of UAC elevation prompts (consent.exe) initiated by PowerShell. This behavior is indicative of privilege escalation attempts, specifically matching the pattern of repeated Start-Process -Verb RunAs usage to solicit user interaction for UAC elevation.
Detects execution of winget.exe with configuration arguments pointing to external or potentially suspicious file extensions like .jpg or .txt. This behavior is indicative of an adversary attempting to execute arbitrary code or scripts masquerading as configuration files, leveraging the Windows Package Manager 'configure' functionality to bypass security controls or execute malicious payloads.
Detects instances where the Windows Management Instrumentation service (WmiPrvSE.exe) spawns a command shell (cmd.exe) with command-line arguments involving standard output redirection (2>&1), often used to capture error and output streams in remote command execution scenarios. This pattern is commonly observed during lateral movement or remote administration activity.
Detects unauthorized local account creation or group membership changes initiated by the Windows Desired State Configuration (DSC) engine, specifically via ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is consistent with techniques used by the DSCourier malware, where DSC resources are abused to establish persistence or facilitate privilege escalation.
Detects modifications to Windows Registry Run or RunOnce keys initiated by 'ConfigurationRemotingServer.exe' or 'WindowsPackageManagerServer.exe'. These processes are associated with Windows Package Manager (WinGet) and Desired State Configuration (DSC). Adversaries may abuse the DSC Script resource or other WinGet mechanisms to gain persistence by injecting malicious entries into these registry keys.
Detects OceanLotus (APT32) activity utilizing DLL sideloading by executing renamed variants of Toolbox.exe (e.g., AutoCad242.exe, Genuine.exe, Updater.exe) with the '-uiDll' command-line flag to load masqueraded payloads with extensions like .json, .conf, or .log.
Detects the execution of discovery commands (e.g., whoami, tasklist, net user) spawned from the OneDrive.Sync.Service.exe process, consistent with behavior from the SPECTRALVIPER XGU module.
Detects the execution of ConfigurationRemotingServer.exe by WindowsPackageManagerServer.exe when the parent process is not winget.exe. This pattern is indicative of unauthorized attempts to invoke the Windows Package Manager DSC (Desired State Configuration) engine directly, bypassing standard tooling and potentially indicating an attempt to leverage COM interface abuse for code execution.
Detects the use of 'winget.exe' to initiate a configuration operation where the provided file path does not use the expected '.yaml' or '.yml' extension. This behavior suggests an attempt to bypass security controls or masquerade malicious content (e.g., as a text or image file) that is then processed by the WinGet DSC engine, potentially leading to unauthorized PowerShell execution.
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
Detects instances where the DllHost.exe process creates files with executable-like extensions (exe, dll, ps1, bat, cmd, vbs, hta, scr) within high-risk, world-writable directories such as C:\Users\Public, C:\Windows\Temp, C:\ProgramData, C:\Users\Default, or AppData\Local\Temp. This behavior is often indicative of malicious activity, such as file drops for further execution or persistence, as legitimate COM surrogate activity rarely results in file creation in these specific locations.
Detects the initialization and execution of processes within the Windows Subsystem for Linux (WSL) environment, specifically tracking the start of WSL processes or the invocation of WSL-related binaries like wsl.exe and vmmem. This allows security teams to monitor interop operations between the host Windows OS and the Linux subsystem.
Detects the co-occurrence of JFMBackdoor DLL sideloading via fltMC.exe and an additional PlugX DLL sideloading event originating from a temporary directory on the same host. This pattern is indicative of the Red Lamassu actor group deploying shared tooling for lateral movement and persistence.
Detects suspicious activities associated with Kimsuky JSE loaders, specifically the self-deletion of .jse files from the Downloads directory by WScript/CScript, or the execution of hidden PowerShell commands designed to decode .a9oc payloads staged in ProgramData.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.
Detects the execution of the Windows shutdown utility (shutdown.exe) with parameters configured to initiate an immediate system shutdown (timer set to 0 seconds). The rule monitors for this command being invoked by common execution engines such as cmd.exe or node.exe, which is often associated with disruptive activity or ransomware attempts.
Detects the use of Wscript.exe or Cscript.exe to spawn wmic.exe with arguments indicative of remote WMI execution, such as 'Win32_Process', 'process call create', or '/node:'. This pattern is frequently associated with lateral movement, worm propagation (like VBScript-based malware), and ransomware deployment.
Page 23 of 29