Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
This rule detects the creation of Microsoft Office files (Word documents, Excel spreadsheets) within the default startup folders for Microsoft Word and Excel. This technique can be used by adversaries to establish persistence, as these files will automatically execute or load when the respective Office application is launched. The rule specifically looks for file creations in paths containing '\Microsoft\Word\STARTUP' or '\Microsoft\Excel\XLSTART', and also considers paths containing both '\Office' and '\Program Files' along with '\STARTUP' or '\XLSTART'. It filters out legitimate creations by the Office applications themselves (WINWORD.exe, EXCEL.exe) to reduce false positives.
This rule detects when specific legitimate Windows applications, including Microsoft Office programs, LOLBINs (Living Off the Land Binaries), and other common executables, create new executable files (.exe, .dll, .ocx) on disk. This behavior is often indicative of malicious activity, such as malware dropping payloads or using trusted processes to evade detection.
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects processes loading modules related to the PCRE.NET package, specifically looking for a unique temporary path often associated with its deployment. This could indicate the execution of code leveraging this package, potentially for malicious purposes like regular expression-based obfuscation or payload delivery.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects the creation of named pipes with specific patterns known to be used by Cobalt Strike's malleable C2 profiles. This rule identifies common pipe names and patterns associated with Cobalt Strike's inter-process communication, including generic profiles and those related to catalog change listeners.
Detects the WMI Event Consumer service process (scrcons.exe) creating a named pipe. This activity can be indicative of WMI persistence mechanisms being used by adversaries, often in conjunction with named pipes for inter-process communication or command and control.
This rule detects the execution of 'remote.exe', a legitimate utility part of WinDbg in the Windows SDK. Adversaries can abuse remote.exe for application whitelisting (AWL) bypass and to execute remote files, making it a living-off-the-land binary (LOLBin). The detection is based on the image path ending with '\remote.exe' or the original filename being 'remote.exe'.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
Detects DNS queries for the domain "anonfiles.com", which is an anonymous file upload platform often used by adversaries for malicious purposes, including data exfiltration. This rule specifically looks for any DNS query containing '.anonfiles.com'.
Detects the creation of memory dump files (.dmp, .hdmp) by common scripting or shell applications such as cmd.exe, powershell.exe, cscript.exe, mshta.exe, pwsh.exe, or wscript.exe. Memory dumps can contain sensitive information like credentials, and their creation by these processes can be indicative of malicious activity, especially if not tied to a legitimate crash.
Detects the creation of specific output files generated by the built-in Windows reconnaissance script "C:\Windows\System32\gatherNetworkInfo.vbs". This script is known to be used by adversaries for system and network information discovery.
Detects the creation of Usage Log files by the CLR (clr.dll) for specific system binaries. These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context. This activity can be indicative of defense evasion techniques where adversaries use trusted binaries to proxy execution of malicious code, and the CLR usage logs can reveal this activity.
This rule detects the creation of executable files (.exe) within the `C:\Windows\WinSxS\` directory by processes that are not located in standard system directories (`C:\Windows\Systems32\`, `C:\Windows\SysWOW64\`, or `C:\Windows\WinSxS\`). This behavior can be indicative of malware attempting to establish persistence or execute from a less commonly monitored system directory, potentially mimicking legitimate system components.
Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects network connections to the Notion API (api.notion.com) from processes that are not recognized legitimate Notion applications or common web browsers. This rule aims to identify potential covert command and control (C2) channels, specifically referencing tools like "OffensiveNotion C2" which leverage Notion's infrastructure for malicious communication.
Detects the creation of a named pipe with the default name used by RemCom, a legitimate remote administration tool that can be abused by attackers for lateral movement and execution.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Page 444 of 465