Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,758 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
968
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,645
658
432
53
30
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,979
1,616
1,042
CVEs
18
14
12
12
11
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. This behavior can be indicative of an adversary attempting to transfer tools or execute scripts from internal network shares.
Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.
Detects process access events where the call trace contains 'cmlua.dll', which is indicative of Microsoft Connection Manager Profile Installer (CMSTP) execution. This activity can be abused by adversaries for code execution and UAC bypass.
Detects uncommon child processes spawned by Appvlp.EXE. Appvlp.EXE, or Application Virtualization Utility, is part of Microsoft Office and can be abused by attackers to execute shell commands, bypass ASR file path rules, or mark files as system files. This rule specifically looks for child processes that are not commonly associated with legitimate Appvlp.EXE operations, such as rundll32.exe, msoasb.exe, skypeserver.exe, and msouc.exe.
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt by adversaries to bypass parent/child relationship detection or application whitelisting rules by using Diskshadow.exe to proxy execution of other binaries like certutil.exe, powershell.exe, or rundll32.exe. This technique is often used for defense evasion and can be part of credential access or data exfiltration attempts.
This rule detects the execution of "LINK.EXE" with an uncommon parent process. LINK.EXE is a Microsoft incremental linker, typically bundled with Visual Studio. Other utilities like editbin.exe, dumpbin.exe, and lib.exe often hardcode calls to "LINK.EXE" without validating its path. This behavior can be exploited by an attacker to sideload a malicious binary named "link.exe" if one of these legitimate tools is executed from an unexpected location. The rule filters out known legitimate parent processes from Visual Studio installation paths to identify suspicious executions.
Detects suspicious execution of rundll32.exe without any command-line parameters, which is a known technique used by Cobalt Strike beacons for defense evasion. The rule specifically filters out common legitimate parent processes to reduce false positives.
Detects the execution of 'wab.exe' (Windows Contacts) and 'wabmig.exe' (Microsoft Address Book Import Tool) when they are launched from non-default, suspicious locations. This behavior has been observed in campaigns involving the Bumblebee loader, where these legitimate Windows executables are abused for malicious purposes, often as part of defense evasion or execution tactics.
Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.
Detects the execution of Microsoft Connection Manager Profile Installer (CMSTP.exe) by monitoring registry events where 'cmmgr32.exe' is the target object. This activity is often associated with defense evasion and execution techniques, as CMSTP can be abused to proxy execution of malicious code, bypass UAC, or load DLLs/COM scriptlets.
Detects the creation of a specific named pipe ('thisispipe') which is known to be used by the DiagTrackEoP Proof-of-Concept tool. This tool exploits the "SeImpersonate" privilege for privilege escalation on Windows systems.
Detects attempts to unload the Sysmon filter driver using 'fltmc.exe'. This activity is often indicative of an adversary trying to impair defenses and remove forensic evidence by disabling Sysmon's monitoring capabilities.
This rule detects the execution of 'wfc.exe', the Workflow Command-line Compiler. This utility is known to be used for Application Whitelisting (AWL) bypasses and is listed in Microsoft's recommended block rules for applications that can bypass Windows Defender Application Control (WDAC). Detection of this executable could indicate an attempt to bypass security controls or execute unauthorized code.
This rule detects the creation of child processes by 'Mftrace.exe', which is a legitimate Windows utility (Trace log generation tool for Media Foundation Tools). Adversaries can abuse 'Mftrace.exe' to execute arbitrary binaries, effectively bypassing application whitelisting or other security controls by proxying execution through a trusted process. The rule specifically looks for any process that has 'mftrace.exe' as its direct parent.
This rule detects the execution of the Ruby interpreter (ruby.exe) with the "-e" flag. This flag allows for inline execution of Ruby code directly from the command line, which can be leveraged by adversaries to execute arbitrary commands, launch reverse shells, or run malicious Ruby scripts without needing to save them to a file. This technique is often used in post-exploitation scenarios or for initial access.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
Detects potentially suspicious child processes of WinRAR.exe.
Detects execution of GfxDownloadWrapper.exe with a URL as an argument to download file.
Detects Access to Domain Group Policies stored in SYSVOL
Detects a process spawned by the terminal service server process (this could be an indicator for an exploitation of CVE-2019-0708)
Page 447 of 465