Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
Detects when an Office application loads the 'kerberos.dll' library. This behavior is unusual for standard Office operations and could indicate an attempt to manipulate Kerberos authentication, potentially for credential access or privilege escalation.
This rule detects suspicious execution of WMIC (Windows Management Instrumentation Command-line) by Microsoft Office applications. Adversaries often leverage Office applications as an initial execution vector and then use LOLBINs (Living Off the Land Binaries) like WMIC to proxy execution, break parent-child process chains, and evade detection. Specifically, this rule looks for Office processes (Word, Excel, PowerPoint, etc.) spawning `wmic.exe` with command-line arguments indicative of process creation and execution of other suspicious LOLBINs such as `regsvr32`, `rundll32`, `msiexec`, `mshta`, `verclsid`, `wscript`, or `cscript`.
Detects Microsoft Word (WINWORD.EXE) starting the uncommon sub-process FLTLDR.exe, which is indicative of exploitation attempts for vulnerabilities like CVE-2017-0261 and CVE-2017-0262. This behavior suggests a malicious document is attempting to execute arbitrary code.
Detects attempts to download a Flash Player update from a suspicious, non-official location. This rule specifically looks for requests containing '/flash_install.php' or ending with '/install_flash_player.exe' that do not originate from a legitimate Adobe domain.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
Detects when a .NET assembly DLL from the Windows assembly cache (C:\Windows\assembly\) is loaded by a Microsoft Office application. This behavior can indicate an attempt to execute malicious code or achieve persistence through Office applications by leveraging .NET assemblies.
Detects the creation of files with '.one' or '.onepkg' extensions in suspicious or uncommon locations, which could indicate the abuse of OneNote attachments for malware delivery. The rule specifically excludes files created by the legitimate OneNote application running from its standard installation path.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
Detects specific process characteristics associated with Maze ransomware droppers. This includes a temporary file being executed as a child process of WINWORD.exe, and the execution of wmic.exe to delete shadow copies, which is a common tactic for ransomware to inhibit system recovery.
Detects Microsoft Excel loading an Add-In (.xll) file. Adversaries may use malicious Excel Add-Ins to execute arbitrary code, establish persistence, or perform other malicious activities. This rule specifically looks for the loading of '.xll' files by 'excel.exe'.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
This rule detects when Microsoft Excel loads an Add-In (.xll) file from an uncommon or potentially suspicious location. Adversaries often use XLL files for initial access or execution by embedding malicious code within them, and loading them from non-standard directories like Desktop, Downloads, Temp, or Public user folders can indicate malicious activity. The rule specifically looks for excel.exe loading an .xll file from a predefined list of suspicious directories.
Detects the creation of recent file shortcuts (.lnk) that point to disk image files (.iso, .img, .vhd, .vhdx). This activity is often observed in phishing attacks where adversaries use these file types to deliver malware. The rule specifically looks for these shortcuts within the 'Recent' folder of a user's profile, indicating that the user has recently interacted with such a file.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects when the 'outlvba.dll' (Microsoft VBA for Outlook Addin) is loaded by the 'outlook.exe' process. This activity can indicate the use of VBA macros within Outlook, which can be leveraged for persistence or execution by adversaries.
Detects an executable in a user's directory that is spawned by a Microsoft Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, Equation Editor). This behavior is often associated with malicious documents attempting to execute payloads.
This rule detects the creation of new entries in the AppCompatFlags\Compatibility Assistant\Store registry key. This key is used by Windows to track applications that have been executed for the first time on an endpoint. This detection can indicate the introduction and initial execution of new software, which could be legitimate or malicious.
Detects any GAC DLL being loaded by an Office Product
Page 85 of 86