Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
306 detections
Filters
Last updated
All Time
Detection languages
142
85
23
18
14
Contributors
73
46
31
30
20
Categories
252
133
60
47
37
Platforms
304
1
1
1
1
Products / Services
116
93
59
20
8
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects msiexec.exe spawning cmd.exe with a command line containing specific indicators related to 'Traiolx Custom Utils' and 'xupdate.bat'. This behavior is indicative of potential malicious installation scripts or installer abuse.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with command line arguments containing suspicious keywords such as 'AppData\Roaming', '.bat', 'xupdate.bat', or 'Traiolx Custom Utils'. This behavior is indicative of potentially malicious installation or post-exploitation activities.
Detects the execution of rundll32.exe when initiated by msiexec.exe or cmd.exe, particularly when the rundll32.exe process path or command line involves the AppData\Roaming directory or references specific custom utilities, which is a common pattern for fileless or staged malware execution.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.
Detects instances where msiexec.exe or cmd.exe initiates a child process, specifically cmd.exe, to execute a batch file (.bat) located within the user's AppData/Roaming directory. This behavior is indicative of potential malicious activity, as adversaries often store and execute payloads in user-writable application data directories to maintain persistence or evade detection.
Detects instances where the Windows Installer (msiexec.exe) initiates a command prompt (cmd.exe) session from an AppData directory. This behavior is indicative of potential malicious activity, as installers are sometimes abused to proxy execution of payloads residing in user-writable temporary directories.
Detects execution of cmd.exe or other binaries spawned by msiexec.exe involving the LegionLoader staging directory 'AppData\Roaming\Traiolx Custom Utils' and the 'xupdate.bat' script, which is characteristic of LegionLoader's post-installation activity.
This rule detects instances where msiexec.exe spawns cmd.exe to execute a batch file located within the user's AppData\Roaming directory. This pattern is indicative of potential malicious activity where msiexec is abused as a proxy for command execution, often used by malware to launch secondary stages from user-writable directories.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects outbound network connections initiated by the Windows Installer utility (msiexec.exe) to non-private (external) IP addresses over standard web ports (80/443). Msiexec.exe can be abused to download and execute malicious payloads or packages from remote locations.
This rule detects the execution of RMM (Remote Monitoring and Management) installers (Atera or SimpleHelp) via msiexec.exe or setup.exe when launched from directories commonly used for downloads (Temp/Downloads) and originating from web browsers or Microsoft Office applications. This behavior is indicative of a potential drive-by download or phishing attack aimed at installing unauthorized remote access software.
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) to execute a batch file located within the user's AppData roaming directory. This behavior is frequently associated with the deployment of malicious payloads or dropper scripts that leverage legitimate installers to maintain persistence or execute unauthorized code.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.
Detects instances where msiexec.exe loads a DLL from non-standard system directories (outside of Program Files or Windows folders) with suspicious naming conventions (e.g., containing 'scheduler', 'update', or 'onedrive'), followed by network activity to public IP ranges or registry persistence modifications. This behavior is indicative of potential DLL side-loading or proxy execution by the Windows Installer binary to achieve persistence or command and control.
Page 8 of 15