Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects signed Windows binaries abused as execution proxies for defense evasion
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects malicious MSI package execution via msiexec for LOLBin abuse
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Detects installation of a remote msi file from web.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory via msiexec.exe, indicating potential unauthorized deployment observed in an in-memory loader attack.
Detects usage of Msiexec.exe to install packages hosted remotely quietly
Detects the unexpected installation of Node.js by an unusual parent process (such as VS Code, cmd, or PowerShell). This behavior is indicative of the StoatWaffle downloader, which automatically fetches and installs the Node.js runtime if it is absent from the target environment.
Detects the execution of msiexec.exe to download and install packages from remote locations. This activity is frequently observed in LeakNet ClickFix campaigns where users are tricked into copying and pasting malicious commands via fake verification prompts.
Detects 'msiexec.exe' being launched from a web browser with a command line containing indicators of remote package download or path traversal. This is a primary indicator of the 'ClickFix' social engineering technique used by LeakNet and other threat actors.
This rule detects when two different MSI installations, both related to known VPN clients (Pulse Secure, Fortinet, Ivanti, GlobalProtect), occur on the same device within a short timeframe. This could indicate an attempt to establish redundant access, bypass security controls, or an unusual administrative activity.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the execution of msiexec.exe to download and install a remote MSI payload from Supabase cloud storage. This technique is known to be used by the Warlock ransomware group to silently deploy the Velociraptor C&C framework while evading network detections.
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Page 11 of 15