Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443. Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages. This rule helps hunt for potentially anomalous or suspicious communications.
Detects the creation of suspicious child processes by 'scrcons.exe' (Script Event Consumer). 'scrcons.exe' is a legitimate Windows component used for WMI event handling, but its spawning of common scripting interpreters, proxy execution binaries, or task schedulers can indicate malicious activity, often related to persistence or execution techniques leveraging WMI.
Detects suspicious child processes spawned by WmiPrvSE.exe, which is often abused by adversaries for execution and defense evasion. The rule specifically looks for common Living Off The Land Binaries (LOLBINs) and scripting interpreters being launched by WmiPrvSE, including certutil, cscript, mshta, msiexec, regsvr32, rundll32, verclsid, wscript, and cmd.exe with specific command-line arguments related to scripting or LOLBINs.
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
This rule detects the creation of an executable file named "msiexec.exe" within the 'bin' directory of a ManageEngine SupportCenter Plus installation. This specific file creation pattern is associated with the exploitation of CVE-2021-44077, a vulnerability for which public Proof-of-Concept (POC) exploits are available. The presence of a newly created 'msiexec.exe' in this non-standard location within the application's directory indicates potential compromise and malicious activity, as legitimate 'msiexec.exe' is a system binary typically located in system directories.
This rule detects indicators of exploitation related to PaperCut MF/NG vulnerabilities. Specifically, it looks for command-line patterns associated with downloading and executing a malicious MSI installer. The first pattern identifies PowerShell commands using 'Invoke-WebRequest' to download 'setup.msi' with hidden window and no profile. The second pattern identifies 'msiexec' being used to install 'setup.msi' with a specific 'IntegratorLogin' parameter, which is a known indicator of the PaperCut exploitation.
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class. This method can be used for defense evasion by leveraging a trusted system utility (PowerShell) and a legitimate WMI class to install software, potentially bypassing traditional application whitelisting or execution policies.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
MsiExec Web Install
Sigma
Detects suspicious execution of msiexec.exe with web addresses as parameters, which can be indicative of an adversary attempting to download and execute malicious MSI packages or DLLs directly from a remote source. This technique is often used for defense evasion and ingress tool transfer.
This rule detects suspicious execution of PowerShell or Command Prompt (cmd.exe) processes where the parent process is MsiExec.exe and the command line contains '-Embedding'. This behavior is often abused by adversaries to proxy the execution of malicious payloads, leveraging msiexec.exe as a trusted binary to bypass application controls.
Adversaries may abuse msiexec.exe to proxy the execution of malicious payloads
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
Page 15 of 15