Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
345 detections
Filters
Last updated
All Time
Detection languages
183
90
20
18
12
Contributors
85
73
57
47
29
Categories
300
166
46
9
9
Platforms
317
25
6
4
3
Products / Services
127
58
46
9
8
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
9
8
1
1
1
IDS Classtypes
2
IDS Protocols
2
Detects the execution of a renamed "ftp.exe" binary based on the PE metadata fields
Detects execution of renamed version of PAExec. Often used by attackers
Detects the execution of a renamed "PingCastle" binary based on the PE metadata fields.
Detects the use of SFTP.exe to execute commands indirectly via ProxyCommand parameter.
Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
Threat actors were seen leveraging this legitimate Windows binary to bypass security controls and execute arbitrary commands while evading detection.
WSL Kali-Linux Usage
Sigma
Detects the use of Kali Linux through Windows Subsystem for Linux
Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)
Detects execution of Microsoft bash launcher with the "-c" flag.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
Detects execution of Microsoft bash launcher without any flags to execute the content of a bash script directly.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
This can be used to potentially bypass defenses and execute Linux or Windows-based binaries directly via bash.
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
ForceV1 asks for information directly from the kernel space. Conhost connects to the console application. High IntegrityLevel means the process is running with elevated privileges, such as an Administrator context.
Detects uncommon "conhost" child processes. This could be a sign of "conhost" usage as a LOLBIN or potential process injection activity.
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Detects execution of powershell scripts via Runscripthelper.exe
Detects processes leveraging the "ms-msdt" handler or the "msdt.exe" binary to execute arbitrary commands as seen in the follina (CVE-2022-30190) vulnerability
Detects execution of msdt.exe using the "cab" flag which could indicates suspicious diagcab files with embedded answer files leveraging CVE-2022-30190
Detects a suspicious child process spawning from Outlook where the image is located in a remote location (SMB/WebDav shares).
Detects potential DLL sideloading using the Microsoft Office winword process via the '/l' flag.
Page 9 of 17