Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.
Initial execution of malicious document calls wmic to execute the file with regsvr32
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
Detects when a browser process or browser tab is launched from an application that handles document files such as Adobe, Microsoft Office, etc. And connects to a web application over http(s), this could indicate a possible phishing attempt.
Detects an executable in the users directory started from one of the Microsoft Office suite applications (Word, Excel, PowerPoint, Publisher, Visio)
Detects a suspicious process spawning from an Outlook process.
A General detection for a new application in AppCompat. This indicates an application executing for the first time on an endpoint.
Detects CLR DLL being loaded by an Office Product
Detects any assembly DLL being loaded by an Office Product
Detects DSParse DLL being loaded by an Office Product
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
Detects Kerberos DLL being loaded by an Office Product
Detects the process injection of a LittleCorporal generated Maldoc.
Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.
This rule will monitor executable and script file creation by office applications. Please add more file extensions or magic bytes to the logic of your choice.
This query helps reviewing malicious email detections by detection methods
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query looks for lnk file executions from other locations than C: -drive, which can relate to mounted ISO-files.
Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-using-mde/
Reference - https://threathunt.blog/detecting-a-payload-delivered-with-iso-files-using-mde/
Page 81 of 86