Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
78
4
4
1
Contributors
39
36
4
3
2
Categories
81
14
3
2
1
Platforms
86
1
Products / Services
30
21
4
4
2
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
1
IDS Protocols
1
Detects the use of "Ilasm.EXE" in order to compile C# intermediate (IL) code to EXE or DLL.
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Use of Remote.exe
Sigma
Remote.exe is part of WinDbg in the Windows SDK and can be used for AWL bypass and running remote files.
Detects the execution of CSharp interactive console by PowerShell
Detects a remote thread creation of Ttdinject.exe used as proxy
Detects execution of "aspnet_compiler.exe" which can be abused to compile and execute C# code.
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Use of Wfc.exe
Sigma
The Workflow Command-line Compiler can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Use of TTDInject.exe
Sigma
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
The "VSIISExeLauncher.exe" binary part of the Visual Studio/VS Code can be used to execute arbitrary binaries
Detects potentially suspicious child processes of "aspnet_compiler.exe".
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Detects execution of "aspnet_compiler.exe" with potentially suspicious paths for compilation.
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a LOLBIN to execute arbitrary commands and binaries.
This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.
Page 3 of 5