Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process memory. This rule specifically looks for access to 'lsass.exe' originating from 'svchost.exe' with a specific suspicious access right ('0x14c0') and a call trace indicating 'seclogon.dll'. This combination suggests an attempt to dump LSASS memory, potentially to steal credentials.
Detects a possible process memory dump of LSASS using processes with whitelisted filenames (like TrolleyExpress.exe, ProcessDump.exe, dump64.exe) to evade detection by security products like Microsoft Defender. The rule specifically looks for access to lsass.exe with granted access rights commonly associated with memory dumping.
Detects suspicious access to the "svchost" process with a high level of granted access (0x1F3FFF) and an unknown call trace. This behavior is often associated with techniques like those used by Invoke-Phantom to terminate critical system processes, such as the Windows event logging service, to evade detection. The rule filters out legitimate MSBuild activity that might exhibit similar call trace characteristics.
This rule detects the execution of the Microsoft bash launcher (bash.exe) without any command-line flags. This behavior can be indicative of an adversary attempting to bypass security defenses by executing Linux or Windows-based binaries indirectly through bash, potentially leveraging it as a living-off-the-land binary (LOLBAS). The rule specifically looks for bash.exe being run without common flags like '-' or an empty command line, suggesting an attempt to execute a script or command without directly specifying it as an argument.
Detects the usage of "findstr" with the argument "385201", which is the default driver altitude for Sysinternals Sysmon. This activity could indicate an adversary attempting to discover if Sysmon is installed on a system, even if the service name has been changed.
Detects when a shell process (bash, cmd, or PowerShell) is spawned by a Java executable. This activity can be indicative of exploitation, such as the Log4j vulnerability, where an attacker leverages a Java application to execute arbitrary commands on the underlying system. The rule filters out common CI build agent activities to reduce false positives.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
This rule detects suspicious execution patterns of mshta.exe, a Microsoft HTML Application host. It specifically looks for mshta.exe being spawned by common scripting or system utilities (cmd.exe, powershell.exe, cscript.exe, wscript.exe, regsvr32.exe, rundll32.exe) or when mshta.exe is executed from suspicious directories like AppData, ProgramData, Users\Public, or Windows\Temp. The rule also flags executions involving .htm or .hta files in the command line, while filtering out legitimate executions from System32 or SysWOW64 directories.
Detects the creation of local user accounts using the `net.exe` or `net1.exe` command-line utility with the `expires:never` option, which indicates that the account password will not expire. This is a common technique used by adversaries to establish persistent access.
This rule detects the execution of the Perl interpreter using the `-e` or `-E` flags. These flags allow for inline execution of Perl code directly from the command line, which can be leveraged by adversaries to launch reverse shells, execute arbitrary commands, or run malicious scripts without needing to write a Perl file to disk. This technique is often used in post-exploitation scenarios for stealthy command execution.
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.
Detects the execution of `regsvr32.exe` to load a DLL hosted on a remote network share. This technique is often used by adversaries for defense evasion and to bypass application control.
Detects various command line and scripting engines/processes such as "PowerShell", "Wscript", "Cmd", etc. spawning a "regsvr32" instance. This behavior is often associated with defense evasion techniques, where adversaries use legitimate Windows utilities to execute malicious code or bypass application whitelisting.
This rule detects the execution of Microsoft Office applications (Excel, Access, Publisher, OneNote, Outlook, PowerPoint, Word) when their executable files have been renamed. It identifies processes where the original file name or description indicates an Office application, but the executed image path does not match the standard, legitimate executable name for that application. This technique is often used by adversaries for defense evasion to bypass security controls that monitor known legitimate application names.
Detects the use of stordiag.exe, a legitimate Windows utility, to execute other system binaries like schtasks.exe, systeminfo.exe, and fltmc.exe. This behavior can be indicative of an adversary attempting to bypass defenses by proxying execution through a trusted binary, a technique often associated with System Binary Proxy Execution (T1218). The rule specifically filters out executions where stordiag.exe is launched from its default system paths to reduce false positives, focusing on instances where it might be copied or used from non-standard locations.
Detects the execution of suspicious scripts (PowerShell, MSHTA, WScript, CScript) from common temporary directories. Adversaries often stage and execute malicious scripts from temporary folders to evade detection and blend in with legitimate system activity. The rule specifically looks for these script interpreters being launched with command lines that include paths to temporary directories, while filtering out some known legitimate activities.
This rule detects instances where 'svchost.exe' is spawned by an uncommon parent process. It specifically filters out common and legitimate parent processes such as 'Mrt.exe', 'MsMpEng.exe', 'ngen.exe', 'rpcnet.exe', 'services.exe', and 'TiWorker.exe', as well as cases where the parent process is null or empty. This helps to identify potential masquerading or defense evasion attempts where an adversary might try to hide malicious activity by naming their process 'svchost.exe' and having it spawned by an unusual parent.
Detects suspicious execution of Sysinternals PsSuspend, where the utility is used to suspend critical processes such as AV or EDR to bypass defenses. The rule specifically looks for the execution of 'pssuspend.exe' or 'pssuspend64.exe' with 'msmpeng.exe' in the command line, which is the executable for Microsoft Defender Antivirus.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Page 446 of 465