Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
87 detections
Filters
Last updated
All Time
Detection languages
78
4
4
1
Contributors
39
36
4
3
2
Categories
81
14
3
2
1
Platforms
86
1
Products / Services
30
21
4
4
2
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
1
IDS Protocols
1
Use of TTDInject.exe
Sigma
Detects the executiob of TTDInject.exe, which is used by Windows 10 v1809 and newer to debug time travel (underlying call of tttracer.exe)
Detects the execution of "aspnet_compiler.exe", a Microsoft .NET Framework utility that can be abused by adversaries to compile and execute C# code. This technique can be used for defense evasion by proxying execution through a trusted developer utility.
This rule detects the execution of the Node.js executable that is bundled with Adobe Creative Cloud, specifically when it is used to execute scripts outside of the legitimate 'Adobe Creative Cloud Experience\js' directory. This behavior can indicate an adversary attempting to leverage a trusted application's bundled interpreter for malicious script execution, potentially bypassing application control or whitelisting solutions.
Detects the execution of "aspnet_compiler.exe" when it attempts to compile files from potentially suspicious or user-writable directories. This behavior can indicate an adversary using a trusted developer utility for defense evasion or to execute malicious code.
Detects the execution of the CSharp interactive console (csi.exe) when it is spawned by PowerShell. This activity can be indicative of an adversary leveraging trusted developer utilities for proxy execution, potentially to bypass application controls or execute malicious code.
This analytic identifies instances where `wmiprvse.exe` spawns `msbuild.exe`. This behavior is unusual and indicates potential misuse of a COM object or a Living Off The Land (LOLBAS) technique. `msbuild.exe` is typically spawned by `devenv.exe` during legitimate Visual Studio use, not by `wmiprvse.exe`. If confirmed malicious, this could indicate an attacker executing arbitrary code or scripts, potentially leading to system compromise or further malicious activities.
The following analytic detects the renaming of microsoft.workflow.compiler.exe, a rarely used executable typically located in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process names and original file names. This activity is significant because renaming this executable can indicate an attempt to evade security controls. If confirmed malicious, an attacker could use this renamed executable to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
This analytic identifies the usage of microsoft.workflow.compiler.exe, a rarely utilized executable typically found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution telemetry. The significance of this activity lies in its uncommon usage, which may indicate malicious intent such as code execution or persistence mechanisms. If confirmed malicious, an attacker could leverage this process to execute arbitrary code, potentially leading to unauthorized access or further compromise of the system.
This rule detects potentially suspicious command-line arguments used with Electron-based applications such as Microsoft Teams, Discord, Slack, Microsoft Edge, and VS Code. The presence of specific command-line switches like '--browser-subprocess-path', '--gpu-launcher', '--renderer-cmd-prefix', or '--utility-cmd-prefix' in conjunction with these applications could indicate an attempt to abuse these signed binaries for proxy execution of malicious code, potentially bypassing security controls.
Detects the execution of Microsoft Workflow Compiler (Microsoft.Workflow.Compiler.exe), which can be abused to execute arbitrary unsigned code. This utility is part of the .NET Framework and can compile and execute workflow definition files. Adversaries may leverage this for defense evasion and execution by proxying malicious code through a trusted, signed binary.
Detects the execution of 'node.exe' with command-line arguments indicative of arbitrary code execution, specifically looking for evaluation flags ('-e', '--eval') combined with patterns suggesting a reverse shell (e.g., '.exec(', 'net.socket', '.connect', 'child_process'). This behavior has been observed in attacks leveraging vulnerabilities like Log4j.
Detects the execution of TTDInject.exe, a legitimate Windows utility used for time travel debugging. This tool can be abused for proxy execution of malicious payloads, bypassing application control solutions.
Detects the creation of a remote thread by 'Ttdinject.exe', which can be abused as a proxy to execute malicious code. This technique is often used for defense evasion.
Detects the use of 'cdb.exe', a legitimate Windows debugger, to execute arbitrary processes or commands. This technique is often used by adversaries to bypass application whitelisting or execute malicious code through a trusted binary. The rule specifically looks for command-line arguments indicative of debugger script execution ('-c' or '-cf').
This rule detects the execution of "VSIISExeLauncher.exe", a legitimate binary associated with Visual Studio/VS Code, when it is used to launch other executables. Adversaries may abuse this utility to proxy execution of malicious payloads, potentially bypassing application control solutions. The detection specifically looks for the execution of VSIISExeLauncher.exe combined with command-line arguments indicating the launch of another program (e.g., using '-p' or '-a').
Detects the execution of the "jsc.exe" (JScript Compiler). Attackers might abuse this in order to compile JScript files on the fly and bypass application whitelisting.
Detects the execution of a signed binary dropped by Kaspersky Lab Products Remover (kavremover) which can be abused as a Living Off The Land Binary (LOLBIN) to execute arbitrary commands and binaries. The rule specifically looks for command lines containing ' run run-cmd ' and excludes executions where the parent process is 'cleanapi.exe' or 'kavremover.exe', as these are legitimate parent processes for the dropped binary.
This rule detects the execution of 'remote.exe', a legitimate utility part of WinDbg in the Windows SDK. Adversaries can abuse remote.exe for application whitelisting (AWL) bypass and to execute remote files, making it a living-off-the-land binary (LOLBin). The detection is based on the image path ending with '\remote.exe' or the original filename being 'remote.exe'.
This rule detects the execution of PowerShell code through the `sqltoolsps.exe` utility, which is part of Microsoft SQL Server Management Studio. This method can be used to bypass logging mechanisms for script blocks, making it a technique for defense evasion.
Detects suspicious child processes spawned by "aspnet_compiler.exe". This often indicates an adversary is abusing the legitimate `aspnet_compiler.exe` utility for proxy execution, potentially to bypass application controls or execute malicious code from unexpected locations. The rule specifically looks for common executables like `calc.exe` or `notepad.exe` and processes launched from suspicious temporary or user-specific directories.
Detects the use of the 'Ilasm.exe' utility to compile C# Intermediate Language (IL) code into executable (EXE) or dynamic-link library (DLL) files. This activity can be indicative of an adversary compiling malicious code on a compromised system, potentially to bypass security controls or execute custom payloads.
Page 4 of 5