Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
256 detections
Filters
Last updated
All Time
Detection languages
133
63
23
18
6
Contributors
63
43
30
19
18
Categories
177
52
37
28
18
Platforms
247
11
6
1
Products / Services
71
51
33
24
7
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects the execution of the Remote Utilities (RURAT) legitimate remote administration tool when its executable name has been changed from its default names (rutserv.exe or rfusclient.exe). It identifies the tool by inspecting the 'Product' field in the PE header, which contains 'Remote Utilities', and then filters out the known legitimate executable names to catch instances where the file has been renamed, often as a defense evasion technique.
Detects the use of bitsadmin.exe to download files into suspicious or commonly abused folders such as temporary directories, program data, or user public folders. This technique is often used by adversaries for ingress tool transfer, defense evasion, and persistence.
This rule detects the execution of the Microsoft Support Diagnostic Tool (msdt.exe) when its executable file has been renamed. Adversaries often rename legitimate system utilities to evade detection mechanisms that might be looking for the original executable name. By checking for the original filename 'msdt.exe' in the process metadata while ensuring the image path does not end with '\msdt.exe', the rule identifies instances where the utility is run under a different name.
Detects the usage of bitsadmin.exe to download files to uncommon target folders such as AppData or Temp directories. This technique is often used by adversaries for ingress tool transfer or to stage malicious payloads.
Page 13 of 13