Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of specific files associated with the Pingback backdoor, which is known to establish an ICMP tunnel for command and control (C2) communications. The rule specifically looks for 'updata.exe' being created and 'C:\Windows\oci.dll' as the target filename, as described in the Trustwave report.
Detects PowerShell writing shortcut (.lnk) files into the Windows startup directory. This technique is commonly used by adversaries to establish persistence, ensuring their malicious code executes each time a user logs in. The rule specifically looks for PowerShell (powershell.exe or pwsh.exe) as the process creating these shortcut files in the 'Start Menu\Programs\Startup' path.
This rule detects when a file is written to the Windows startup directory. This activity is a common technique used by adversaries to establish persistence on a system, ensuring that their malicious code executes automatically when a user logs in or the system boots. The rule specifically looks for file creation events where the target filename contains the path to the 'Start Menu\Programs\StartUp' directory. It includes filters to reduce false positives from legitimate system processes like Windows Update and Microsoft OneNote.
Detects the creation of potentially malicious script and executable files in Windows startup folders, which is a common persistence technique used by threat actors. These files (.ps1, .vbs, .js, .bat, etc.) are automatically executed when a user logs in, making the Startup folder an attractive target for attackers. This technique is frequently observed in malvertising campaigns and malware distribution where attackers attempt to maintain long-term access to compromised systems.
Detects the creation of a macro file for Outlook, specifically 'VbaProject.OTM', which can be used for persistence or to execute malicious code. The rule filters out legitimate creations by 'outlook.exe' to reduce false positives.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. This rule detects the creation of new custom shim database files in the default Windows shim database directories, which can indicate an attempt to abuse the Application Compatibility Infrastructure for malicious purposes.
This rule detects a suspicious activity chain where an SVG file is created by Outlook, immediately followed by a browser downloading a potentially malicious payload (archive, executable, or script file) on the same device within a short timeframe. This pattern could indicate a social engineering attack where a user is tricked into opening a malicious SVG attachment, which then leads to the download of a secondary malicious file.
This rule detects the creation or modification of the `/etc/ld.so.preload` file. This file is used by the dynamic linker (`ld.so`) on Linux systems to specify shared libraries that should be loaded before any other libraries. Adversaries can leverage this mechanism for persistence, privilege escalation, or defense evasion by preloading malicious libraries, effectively hijacking legitimate functions. Refer to `man ld.so` for more details on its functionality.
Detects msdt.exe creating files in suspicious directories, which could indicate exploitation of vulnerabilities like Follina (CVE-2022-30190) or Dogwalk. The rule specifically looks for file creations in common startup locations, public user directories, or system logs directories.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Detects the creation of a specific PowerShell module file ('webAdministration.psm1') within the WindowsPowerShell Modules directory, which is indicative of an attempt to exploit CVE-2022-24527, a local privilege escalation vulnerability in Microsoft Connected Cache. The rule filters out activity by authorized users to reduce false positives.
This rule detects the creation of an executable file named 'program.exe' directly in the root of the C:\ drive. This specific file name and location are commonly associated with attempts to exploit unquoted service paths, where an attacker places a malicious executable in a higher-level directory to be executed instead of the legitimate program due to the lack of quotation marks in the service path.
This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.
This rule detects the creation of suspicious executable files (.dll or .exe) by Microsoft Sync Center (mobsync.exe). While mobsync.exe is a legitimate Windows process for synchronizing offline files, its use to create executable files can be indicative of malicious activity, such as persistence, defense evasion, or privilege escalation, where an attacker might be attempting to drop and execute malicious payloads using a trusted system binary.
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.
KQL Query from file: 7-Zip CVE-2025-11002 Detection
Detects potential DLL side-loading used by the AdaptixC2 framework, where a malicious DLL is dropped into the C:\Windows\Tasks directory, followed by the execution of a copied msdtc.exe from the same location.
Detects when a 7-Zip process, potentially running from a user directory, writes a file to a sensitive system location. This could indicate a directory traversal attack (e.g., CVE-2025-11001, CVE-2025-11002) where a malicious archive writes a file outside of the intended extraction path. The rule specifically looks for 7-Zip processes initiated from common user-land folders (like Downloads, Desktop, Documents, Temp) creating files in sensitive system directories (like C:\Windows, C:\Windows\System32, C:\ProgramData, or Startup folders), while excluding legitimate installations to Program Files.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Detects when a 7-Zip process creates an executable file in a sensitive system directory. This could indicate exploitation of a vulnerability like CVE-2025-11001 or CVE-2025-11002, where a malicious archive writes a file to an unexpected location to achieve persistence or code execution.
Page 194 of 216