Techniques › T1218 › T1218.015
T1218.015 Electron Applications
stealth — Linux, macOS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1218.015
0
KEV CVEs mapped here
<p>Adversaries may abuse components of the Electron framework to execute malicious code. The Electron framework hosts many common applications such as Signal, Slack, and Microsoft Teams. Originally developed by GitHub, Electron is a cross-platform desktop application development framework that employs web technologies like JavaScript, HTML, and CSS. The Chromium engine is used to display web content and Node.js runs the backend code.</p><p>Due to the functional mechanics of Electron (such as allowing apps to run arbitrary commands), adversaries may also be able to perform malicious functions in the background potentially disguised as legitimate tools within the framework. For example, the abuse of
teams.exe and chrome.exe may allow adversaries to execute malicious commands as child processes of the legitimate application (e.g., chrome.exe --disable-gpu-sandbox --gpu-launcher="C:\Windows\system32\cmd.exe /c calc.exe).</p><p>Adversaries may also execute malicious content by planting malicious JavaScript within Electron applications.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0025 Detecting Electron Application Abuse for Proxy Execution v1.0
AN0071 WindowsAbuse of trusted Electron apps (Teams, Slack, Chrome) to spawn child processes or execute payloads via malicious command-line arguments (e.g., --gpu-launcher) and modified app resources (.asar). Behavior chain: suspicious parent process (Electron app) → unusual command-line args → child process creation → optional DLL/network artifacts.Tunable:
TimeWindowUserContextAllowedElectronAppsAllowedChildProcessesElectronAppDomainAllowlistAsarIntegrityHashAN0072 LinuxAbuse of Linux Electron binaries by modifying app.asar or config JS files and spawning unexpected child processes (bash, curl, python).auditd:SYSCALLexecve: Electron-based binary spawning shell or script interpreter→ DC0032 Process CreationTunable:AsarIntegrityCheckSuspiciousChildProcessesAN0073 macOSAbuse of macOS Electron apps by modifying app.asar bundles and spawning child processes (osascript, curl, sh) from Electron executables.Tunable:AllowedAppBundlePathsSignedToUnsignedTransition
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1218.015
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1218) 153
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · 01c42d3c-242d-4655-85b2-34f1739632f7
Detects usage of Dsacls to grant over permissive permissions
Author: frack113
· 2022-03-06 (modified 2023-08-03) · logsource: product=windows category=process_creation · 02b18447-ea83-4b1b-8805-714a8a34546a
Detects execution of Windows Defender "OfflineScannerShell.exe" from its non standard directory.
The "OfflineScannerShell.exe" binary is vulnerable to DLL side loading and will load any DLL named "mpclient.dll" from the current working directory.
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 04936b66-3915-43ad-a8e5-809eadfd1141
Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=image_load · 04fc4b22-91a6-495a-879d-0144fec5ec03
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
· 2020-10-06 (modified 2022-10-09) · logsource: product=windows category=process_creation · 0b4ae027-2a2d-4b93-8c7e-962caaba5b2a
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Author: Maxime Thiebaut (@0xThiebaut)
· 2021-10-21 (modified 2022-12-25) · logsource: product=windows category=process_creation · 0bbc6369-43e3-453d-9944-cae58821c173
Detects using WorkFolders.exe to execute an arbitrary control.exe
Author: Ivan Dyachkov, oscd.community
· 2020-10-07 (modified 2024-03-13) · logsource: product=windows category=process_creation · 0c2f8629-7129-4a8a-9897-7e0768f13ff2
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag. Attackers often abuse "diskshadow" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.
Author: frack113
· 2022-12-31 · logsource: product=windows category=image_load · 0fa66f66-e3f6-4a9c-93f8-4f2610b00171
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Author: frack113
· 2021-07-13 (modified 2023-11-09) · logsource: product=windows category=process_creation · 104cdb48-a7a8-4ca7-a453-32942c6e5dcb
Detects usage of "ProtocolHandler" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\Microsoft\Windows\INetCache\IE)
Author: Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community
· 2020-10-14 (modified 2022-10-09) · logsource: product=windows category=process_creation · 15c7904e-6ad1-4a45-9b46-5fb25df37fd2
There is an option for a MS VS Just-In-Time Debugger "vsjitdebugger.exe" to launch specified executable and attach a debugger.
This option may be used adversaries to execute malicious code by signed verified binary.
The debugger is installed alongside with Microsoft Visual Studio package.
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
· 2023-11-09 · logsource: product=windows category=process_creation · 180c7c5c-d64b-4a63-86e9-68910451bc8b
Detects usage of the "ms-appinstaller" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE
The downloaded files are temporarly stored in ":\Users\%username%\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\AC\INetCache\<RANDOM-8-CHAR-DIRECTORY>"
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 · logsource: product=windows category=process_creation · 1c8774a0-44d4-4db0-91f8-e792359c70bd
Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-12-10 · logsource: product=windows category=file_event · 1cf465a1-2609-4c15-9b66-c32dbe4bfd67
Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.
Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · 1d174d38-8fda-4081-a9b6-56d9763c0cd8
Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.
This facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-12 (modified 2026-08-06) · logsource: product=windows category=process_creation · 1dd05363-104e-4b4a-b963-196a534b03a1
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 1dde5376-a648-492e-9e54-4241dd9b0c7f
Detects execution of "Diskshadow.exe" in script mode to execute an script with a potentially uncommon extension.
Initial baselining of the allowed extension list is required.
Author: frack113
· 2022-05-16 (modified 2023-06-14) · logsource: product=windows category=process_creation · 1e59c230-6670-45bf-83b0-98903780607e
Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
· 2022-06-09 (modified 2023-11-09) · logsource: product=windows category=process_creation · 1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c
Detects the usage of the "Squirrel.exe" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
Author: Sreeman, Nasreddine Bencherchali (Nextron Systems)
· 2020-01-13 (modified 2024-03-05) · logsource: product=windows category=process_creation · 21dd6d38-2b18-4453-9404-a0fe4a0cc288
Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.
Author: Meroujan Antonyan (vx3r)
· 2025-06-05 · logsource: product=windows category=process_creation · 222720a7-047f-4054-baa5-bab9be757db0
Detects the execution of PowerShell commands that attempt to install MSI packages via the
Windows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.
This could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.
And the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-23 (modified 2023-08-15) · logsource: product=windows category=process_creation · 2267fe65-0681-42ad-9a6d-46553d3f3480
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL
Author: Austin Songer @austinsonger
· 2021-10-23 (modified 2024-03-05) · logsource: product=windows category=process_creation · 242301bc-f92f-4476-8718-78004a6efd9f
Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.
Author: Austin Songer @austinsonger
· 2021-11-05 (modified 2022-07-07) · logsource: product=windows category=process_creation · 28c8f68b-098d-45af-8d43-8089f3e35403
Detects potential abuse of the "register_app.vbs" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
· 2023-08-08 · logsource: product=windows category=process_creation · 2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Author: Ayush Anand (Securityinbits)
· 2026-04-28 · logsource: product=windows category=process_creation · 2fcda7e2-8c57-4904-86ac-37fc3157e09d
Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2020-01-28 (modified 2025-01-22) · logsource: product=windows category=process_creation · 340a090b-c4e9-412e-bb36-b4b16fe96f9b
Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
Author: frack113
· 2021-07-16 (modified 2022-06-22) · logsource: product=windows category=process_creation · 36475a7d-0f6d-4dce-9b01-6aeb473bbaf1
Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs
Author: Nasreddine Bencherchali (Nextron Systems), frack113
· 2021-07-13 (modified 2023-05-09) · logsource: product=windows category=ps_module · 38a7625e-b2cb-485d-b83d-aff137d859f4
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Author: Florian Roth (Nextron Systems), Tim Shelton
· 2018-04-06 (modified 2023-05-23) · logsource: product=windows category=process_creation · 3a6586ad-127a-4d3b-a677-1e6eacdf8fde
Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.
Author: Omar Khaled (@beacon_exe)
· 2024-08-21 · logsource: product=macos category=process_creation · 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 (modified 2023-02-08) · logsource: product=windows category=process_creation · 3b3c7f55-f771-4dd6-8a6e-08d057a17caf
Detects usage of "MSPUB" (Microsoft Publisher) to download arbitrary files
Author: elhoim
· 2022-04-28 (modified 2022-06-02) · logsource: product=windows category=file_event · 409f8a98-4496-4aaa-818a-c931c0a8b832
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Author: Konstantin Grishchenko, oscd.community
· 2020-10-17 (modified 2022-07-11) · logsource: product=windows category=process_creation · 40b95d31-1afc-469e-8d34-9a3a667d058e
Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'
Author: Nik Seetharaman, frack113
· 2019-01-16 (modified 2023-02-03) · logsource: product=windows category=process_creation · 419dbf2b-8a9b-4bea-bf99-7544b050ec8d
Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.
Author: bohops
· 2022-10-30 · logsource: product=windows category=process_creation · 43103702-5886-11ed-9b6a-0242ac120002
Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter
Author: Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community
· 2022-06-09 (modified 2025-10-07) · logsource: product=windows category=process_creation · 45239e6a-b035-4aaf-b339-8ad379fcb67e
Detects the usage of the "Squirrel.exe" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 (modified 2023-11-09) · logsource: product=windows category=process_creation · 459f2f98-397b-4a4a-9f47-6a5ec2f1c69d
Detects usage of "MSOHTMED" to download arbitrary files
Author: Matthew Matchen
· 2020-09-04 (modified 2023-11-09) · logsource: product=windows category=process_creation · 46123129-1024-423e-9fae-43af4a0fa9a5
Detects the use of Windows Defender MpCmdRun.EXE to download files
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
· 2023-09-18 · logsource: product=windows category=process_creation · 4f2cd9b6-4a17-440f-bb2a-687abb65993a
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
· 2023-09-18 (modified 2024-07-16) · logsource: product=windows category=network_connection · 5205613d-2a63-4412-a895-3a2458b587b3
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
Author: Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · 52cad028-0ff0-4854-8f67-d25dfcbc78b4
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-07 (modified 2024-08-15) · logsource: product=windows category=process_creation · 53d4bb30-3f36-4e8a-b078-69d36c4a79ff
Detects the execution of Xwizard tool with the "RunWizard" flag and a GUID like argument.
This utility can be abused in order to run custom COM object created in the registry.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-14 · logsource: product=windows category=process_creation · 53d8d3e1-ca33-4012-adf3-e05a4d652e34
Detects the execution of "dotnet-dump" with the "collect" flag. The execution could indicate potential process dumping of critical processes such as LSASS.
Author: Stamatis Chatzimangou
· 2022-10-23 · logsource: product=windows service=application · 5594e67a-7f92-4a04-b65d-1a42fd824a60
Detects installation of a remote msi file from web.
Author: Harjot Singh @cyb3rjy0t
· 2023-09-15 · logsource: product=windows category=process_creation · 56b1dde8-b274-435f-a73a-fb75eb81262a
Detects any child process spawning from "Diskshadow.exe". This could be due to executing Diskshadow in interpreter mode or script mode and using the "exec" flag to launch other applications.
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2024-03-05) · logsource: product=windows category=process_creation · 587254ee-a24b-4335-b3cd-065c0f1f4baa
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-01-26 (modified 2023-10-25) · logsource: product=windows category=process_creation · 5a3164f2-b373-4152-93cf-090b13c12d27
Detects uncommon or suspicious child processes spawning from a VsCode "code.exe" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-13 · logsource: product=windows category=process_creation · 6004abd0-afa4-4557-ba90-49d172e0a299
Detects indirect command execution via Program Compatibility Assistant "pcwrun.exe" leveraging the follina (CVE-2022-30190) vulnerability
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2022-06-09) · logsource: product=windows category=process_creation · 60f16a96-db70-42eb-8f76-16763e333590
Detects the execution of "DXCap.EXE" with the "-c" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
· 2023-09-18 (modified 2025-02-24) · logsource: product=windows category=process_creation · 6120ac2a-a34b-42c0-a9bd-1fb9f459f348
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.
Author: Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
· 2023-09-18 · logsource: product=windows category=process_creation · 631b22a4-70f4-4e2f-9ea8-42f84d9df6d8
Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.
Author: Agro (@agro_sev) oscd.community
· 2020-10-13 (modified 2021-11-27) · logsource: product=windows category=process_creation · 634b00d5-ccc3-4a06-ae3b-0ec8444dd51b
Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces
Adversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-29 · logsource: product=windows category=process_creation · 63f3605b-979f-48c2-b7cc-7f90523fed88
Detects potential suspicious child processes of "3CXDesktopApp.exe". Which could be related to the 3CXDesktopApp supply chain compromise
Author: Sittikorn S
· 2021-06-22 (modified 2023-02-03) · logsource: product=windows category=process_creation · 643bdcac-8b82-49f4-9fd9-25a90b929f3b
Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.
Author: Beyu Denis, oscd.community
· 2020-10-18 (modified 2021-11-27) · logsource: product=windows category=process_creation · 646bc99f-6682-4b47-a73a-17b1b64c9d34
Detects file execution using the msdeploy.exe lolbin
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-01 · logsource: product=windows category=process_creation · 64760eef-87f7-4ed3-93fd-655668ea9420
The "ScriptRunner.exe" binary can be abused to proxy execution through it and bypass possible whitelisting
Author: frack113, Florian Roth
· 2022-08-21 · logsource: product=windows category=file_event · 654fcc6d-840d-4844-9b07-2c3300e54a26
Detects programs on a Windows system that should not write an archive to disk
Author: Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)
· 2023-04-11 · logsource: product=windows category=process_creation · 65c3ca2c-525f-4ced-968e-246a713d164f
Detects renamed execution of "Microsoft.NodejsTools.PressAnyKey.exe", which can be abused as a LOLBIN to execute arbitrary binaries
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-09-01 (modified 2023-02-14) · logsource: product=windows category=process_creation · 6c6d9280-e6d0-4b9d-80ac-254701b64916
Detects possible NTLM coercion via certutil using the 'syncwithWU' flag
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-18 · logsource: product=windows category=image_load · 6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.
This technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)
which can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-22 (modified 2024-06-27) · logsource: product=windows category=process_creation · 6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6
Detects an uncommon parent process of "LINK.EXE".
Link.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.
Multiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the "LINK.EXE" binary without checking its validity.
This would allow an attacker to sideload any binary with the name "link.exe" if one of the aforementioned tools get executed from a different location.
By filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.
Author: @gott_cyber
· 2022-09-02 (modified 2023-03-14) · logsource: product=windows category=process_creation · 6f535e01-ca1f-40be-ab8d-45b19c0c8b7f
Detects the execution of "Ldifde.exe" with the import flag "-i". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.
Author: Swachchhanda Shrawan Poudel
· 2023-08-02 (modified 2023-08-17) · logsource: product=windows category=registry_set · 7021255e-5db3-4946-a8b9-0ba7a4644a69
Detects potential abuse of the provisioning registry key for indirect command execution through "Provlaunch.exe".
Author: frack113
· 2022-12-29 (modified 2024-06-04) · logsource: product=windows category=process_creation · 727454c0-d851-48b0-8b89-385611ab0704
Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"
Author: Florian Roth (Nextron Systems)
· 2022-01-11 (modified 2024-11-23) · logsource: product=windows category=process_creation · 729ce0ea-5d8f-4769-9762-e35de441586d
Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 (modified 2023-11-09) · logsource: product=windows category=process_creation · 75edd216-1939-4c73-8d61-7f3a0d85b5cc
Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to "%LOCALAPPDATA%\Microsoft\Windows\INetCache\IE\"
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-02-05 · logsource: product=windows category=file_event · 760e75d8-c3b5-409b-a9bf-6130b4c4603f
Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Author: andrewdanis
· 2025-10-23 · logsource: product=windows category=process_creation · 78f10490-f2f4-4d19-a75b-4e0683bf3b8d
Detects suspicious Speech Runtime Binary Execution by monitoring its child processes.
Child processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.
Author: Nextron Systems
· 2022-06-01 (modified 2023-02-06) · logsource: product=windows category=process_creation · 7a74da6b-ea76-47db-92cc-874ad90df734
Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation
Author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2021-12-20 (modified 2025-04-12) · logsource: product=windows category=process_creation · 7cce6fc8-a07f-4d84-a53e-96e1879843c9
Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
Author: frack113, Florian Roth (Nextron Systems)
· 2022-08-21 (modified 2026-05-11) · logsource: product=windows category=file_event · 7d604714-e071-49ff-8726-edeb95a70679
Detects LOLBINs and applications that should not legitimately drop script files to disk.
This may indicate malware staging or abuse of a trusted binary for script-based code execution.
Author: frack113, Nasreddine Bencherchali
· 2022-12-29 (modified 2025-10-16) · logsource: product=windows category=process_creation · 7d6d30b8-5b91-4b90-a891-46cccaf29598
Detect usage of the "ssh.exe" binary as a proxy to launch other programs.
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards
· 2022-12-24 (modified 2024-08-07) · logsource: product=windows category=process_creation · 7efd2c8d-8b18-45b7-947d-adfe9ed04f61
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
Author: Josh Nickels, mttaggart
· 2024-07-11 · logsource: product=windows category=process_creation · 7f2376f9-42ee-4dfc-9360-fecff9a88fc8
Detects the execution of "BitLockerToGo.EXE".
BitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.
This is a rarely used application and usage of it at all is worth investigating.
Malware such as Lumma stealer has been seen using this process as a target for process hollowing.
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel
· 2023-08-08 · logsource: product=windows category=process_creation · 7f5d1c9a-3e83-48df-95a7-2b98aae6c13c
Detects child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-16 · logsource: product=windows category=process_creation · 811f459f-9231-45d4-959a-0266c6311987
Detects suspicious child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Author: Beyu Denis, oscd.community
· 2019-10-26 (modified 2024-04-24) · logsource: product=windows category=process_creation · 81ebd28b-9607-4478-bf06-974ed9d53ed7
Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.
Attackers might abuse this in order to bypass application whitelisting.
Author: @gott_cyber, Nasreddine Bencherchali (Nextron Systems)
· 2022-12-11 (modified 2024-06-26) · logsource: product=windows category=process_creation · 835e75bf-4bfd-47a4-b8a6-b766cac8bcb7
Detects uncommon child process of Setres.EXE.
Setres.EXE is a Windows server only process and tool that can be used to set the screen resolution.
It can potentially be abused in order to launch any arbitrary file with a name containing the word "choice" from the current execution path.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · 84232095-ecca-4015-b0d7-7726507ee793
Detects when a user installs certificates by using CertOC.exe to load the target DLL file.
Author: Swachchhanda Shrawan Poudel
· 2023-11-09 · logsource: product=windows category=process_creation · 863218bd-c7d0-4c52-80cd-0a96c09f54af
Detects usage of "IMEWDBLD.exe" to download arbitrary files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-12 (modified 2024-03-19) · logsource: product=windows category=process_creation · 8e0bb260-d4b2-4fff-bb8d-3f82118e6892
Detects inline Windows shell commands redirecting output via the ">" symbol to a suspicious location.
This technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as "hostname" and "dir" to files for future exfiltration.
Author: Florian Roth (Nextron Systems)
· 2022-01-11 (modified 2023-04-06) · logsource: product=windows category=process_creation · 90d50722-0483-4065-8e35-57efaadd354d
Detects a certain command line flag combination used by "devinit.exe", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system
Author: frack113
· 2021-11-07 (modified 2022-12-25) · logsource: product=windows category=process_creation · 90dcf730-1b71-4ae7-9ffc-6fcf62bd0132
ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.
Author: Jimmy Bayne (@bohops)
· 2024-01-02 · logsource: product=windows category=process_creation · 9257c05b-4a4a-48e5-a670-b7b073cf401b
Detects commandline arguments for executing a child process via dotnet-trace.exe
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-29 (modified 2024-11-23) · logsource: product=windows category=process_creation · 93bbde78-dc86-4e73-9ffc-ff8a384ca89c
Detects execution of known compromised version of 3CXDesktopApp
Author: Mateusz Wydra, oscd.community
· 2020-10-13 (modified 2023-01-19) · logsource: product=windows category=registry_event · 9577edbb-851f-4243-8c91-1d5b50c1a39b
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Author: Austin Songer (@austinsonger)
· 2021-10-21 (modified 2022-12-25) · logsource: product=windows category=process_creation · 961e0abb-1b1e-4c84-a453-aafe56ad0d34
Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=process_access · 9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe)
accessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting
Process.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers
instead of legitimate system binaries. The vulnerability allows unauthorized code execution through
external control of file names or paths via WebDAV.
Author: Sreeman
· 2020-03-13 (modified 2023-11-09) · logsource: product=windows category=process_creation · 9c7e131a-0f2c-4ae0-9d43-b04f4e266d43
Detects uncommon child processes of Appvlp.EXE
Appvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse "AppVLP" to execute shell commands.
Normally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder
or to mark a file as a system file.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-13 (modified 2025-10-29) · logsource: product=windows category=process_creation · 9c8c7000-3065-44a8-a555-79bcba5d9955
Detects execution of "msdt.exe" using an answer file which is simulating the legitimate way of calling msdt via "pcwrun.exe" (For example from the compatibility tab).
Author: frack113, manasmbellani
· 2022-02-16 (modified 2025-10-31) · logsource: product=windows category=process_creation · 9cfc00b6-bfb7-49ce-9781-ef78503154bb
Detects the execution of "Wlrmdr.exe" with the "-u" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries.
This detection also focuses on any uncommon child processes spawned from "Wlrmdr.exe" as a supplement for those that posses "ParentImage" telemetry.
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
· 2020-10-05 (modified 2024-06-21) · logsource: product=windows category=process_creation · 9eb271b9-24ae-4cd4-9465-19cfc1047f3e
Detects the creation of a child "explorer.exe" process from a shell like process such as "cmd.exe" or "powershell.exe".
Attackers can use "explorer.exe" for evading defense mechanisms by proxying the execution through the latter.
While this is often a legitimate action, this rule can be use to hunt for anomalies.
Muddy Waters threat actor was seeing using this technique.
Author: Bhabesh Raj, X__Junior (Nextron Systems)
· 2021-07-30 (modified 2024-11-13) · logsource: product=windows category=process_creation · 9f107a84-532c-41af-b005-8d12a607639f
Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks
Author: elhoim
· 2022-04-28 (modified 2024-03-12) · logsource: product=windows category=network_connection · 9f2cc74d-78af-4eb2-bb64-9cd1d292b87b
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Author: andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-18 · logsource: product=windows category=process_creation · 9f38c1db-e2ae-40bf-81d0-5b68f73fb512
Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes.
Suspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-15 · logsource: product=windows category=process_creation · 9f546b25-5f12-4c8d-8532-5893dcb1e4b8
Detects potentially suspicious child processes of "Diskshadow.exe". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-01-11 (modified 2023-04-11) · logsource: product=windows category=process_creation · a20391f8-76fb-437b-abc0-dba2df1952c6
Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary
Author: frack113
· 2021-07-13 (modified 2023-05-09) · logsource: product=windows category=process_creation · a6fc3c46-23b8-4996-9ea2-573f4c4d88c5
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-11-10 · logsource: product=windows category=process_creation · a85ffc3a-e8fd-4040-93bf-78aff284d801
Detects the usage of the "sftp.exe" binary as a LOLBIN by abusing the "-D" flag
Author: Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community
· 2019-10-26 (modified 2023-08-16) · logsource: product=windows category=process_creation · aaf46cdc-934e-4284-b329-34aa701e3771
Detects uncommon child processes of "BgInfo.exe" which could be a sign of potential abuse of the binary to proxy execution via external VBScript
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-02-05 · logsource: product=windows category=file_executable_detected · ab90dab8-c7da-4010-9193-563528cfa347
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-06-13 · logsource: product=windows category=process_creation · abe06362-a5b9-4371-8724-ebd00cd48a04
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
which involves unauthorized code execution via WebDAV through external control of file names or paths.
The exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe by manipulating
their working directories to point to attacker-controlled WebDAV servers, causing them to execute
malicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries
through Process.Start() search order manipulation.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-03 · logsource: product=windows category=process_creation · ac1c92b4-ac81-405a-9978-4604d78cc47e
Detects execution of "VSDiagnostics.exe" with the "start" command in order to launch and proxy arbitrary binaries.
Author: Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-03 · logsource: product=windows category=process_creation · af5732ed-764e-489d-826d-0447c8b36242
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team
· 2020-10-12 (modified 2023-11-11) · logsource: product=windows category=process_creation · af77cf95-c469-471c-b6a0-946c685c4798
Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 (modified 2023-11-09) · logsource: product=windows category=process_creation · b124ddf4-778d-418e-907f-6dd3fc0d31cd
Detects usage of "PresentationHost" which is a utility that runs ".xbap" (Browser Applications) files to download arbitrary files
Author: frack113
· 2022-12-31 (modified 2024-04-22) · logsource: product=windows category=process_creation · b2309017-4235-44fe-b5af-b15363011957
Detects uncommon child processes of "DefaultPack.EXE" binary as a proxy to launch other programs
Author: Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)
· 2024-02-05 (modified 2024-06-04) · logsource: product=windows category=process_creation · b2b048b0-7857-4380-b0fb-d3f0ab820b71
Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.
This behavior has been observed in-the-wild by different threat actors.
Author: Christopher Peacock @SecurePeacock, SCYTHE @scythe_io
· 2022-06-01 · logsource: product=windows category=process_creation · b30a8bc5-e21b-4ca2-9420-0a94019ac56a
VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.
Author: Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)
· 2023-09-18 · logsource: product=windows category=process_creation · b5746143-59d6-4603-8d06-acbd60e166ee
Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.
Author: Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)
· 2019-10-26 (modified 2024-04-22) · logsource: product=windows category=process_creation · b5c7395f-e501-4a08-94d4-57fe7a9da9d2
Detects usage of "cdb.exe" to launch arbitrary processes or commands from a debugger script file
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-08-19 · logsource: product=windows category=process_creation · b8b1b304-a60f-4999-9a6e-c547bde03ffd
Detects the execution of DeviceCredentialDeployment to hide a process from view.
Author: A. Sungurov , oscd.community
· 2020-10-12 (modified 2021-11-27) · logsource: product=windows category=process_creation · b97cd4b1-30b8-4a9d-bd72-6293928d52bc
Detect indirect command execution via Program Compatibility Assistant pcwrun.exe
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-06-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · bac9fb54-2da7-44e9-988f-11e9a5edbc0c
Detects possible password spraying attempts using Dsacls
Author: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative
· 2020-10-05 (modified 2022-07-07) · logsource: product=windows category=process_creation · bafac3d6-7de9-4dd9-8874-4a1194b493ed
Attackers can use print.exe for remote file copy
Author: Liran Ravich, Nasreddine Bencherchali
· 2025-10-22 · logsource: product=windows category=process_creation · bcfece3d-56fe-4545-9931-3b8e92927db1
Detects the execution of Winrs.exe where it is used to execute commands locally.
Commands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.
Author: Nasreddine Bencherchali (Nextron Systems), memory-shards
· 2022-12-24 (modified 2024-08-07) · logsource: product=windows category=process_creation · c0b40568-b1e9-4b03-8d6c-b096da6da9ab
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
· 2024-02-05 · logsource: product=windows category=process_creation · c2b478fc-09bf-40b2-8768-ab3ec8d61c9a
Detects the "iexpress.exe" utility creating self-extracting packages.
Attackers where seen leveraging "iexpress" to compile packages on the fly via ".sed" files.
Investigate the command line options provided to "iexpress" and in case of a ".sed" file, check the contents and legitimacy of it.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
· 2020-10-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · c649a6c7-cd8c-4a78-9c04-000fc76df954
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-05-09 · logsource: product=windows category=ps_script · cacef8fc-9d3d-41f7-956d-455c6e881bc5
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Author: Beyu Denis, oscd.community (rule), @_felamos (idea)
· 2019-10-12 (modified 2021-11-27) · logsource: product=windows category=process_creation · cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6
The Devtoolslauncher.exe executes other binary
Author: Julia Fomina, oscd.community
· 2020-10-09 · logsource: product=windows category=process_creation · cd3d1298-eb3b-476c-ac67-12847de55813
Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.
Author: frack113
· 2022-12-29 · logsource: product=windows category=process_creation · cd71385d-fd9b-4691-9b98-2b1f7e508714
Detect usage of the "runexehelper.exe" binary as a proxy to launch other programs
Author: Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)
· 2023-10-17 · logsource: product=windows category=process_creation · ce2c44b5-a6ac-412a-afba-9e89326fa972
Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location.
When Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.
Author: frack113
· 2021-07-13 (modified 2022-10-09) · logsource: product=windows category=process_creation · ce7cf472-6fcc-490a-9481-3786840b5d9b
Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.
Author: Beyu Denis, oscd.community (rule), @harr0ey (idea)
· 2019-10-12 (modified 2021-11-27) · logsource: product=windows category=process_creation · cec8e918-30f7-4e2d-9bfa-a59cc97ae60f
The OpenWith.exe executes other binary
Author: bartblaze
· 2020-07-13 (modified 2024-07-16) · logsource: product=windows category=network_connection · cfed2f44-16df-4bf3-833a-79405198b277
Detects Dllhost.EXE initiating a network connection to a non-local IP address.
Aside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.
An initial baseline is recommended before deployment.
Author: Victor Sergeev, oscd.community
· 2020-10-09 (modified 2025-10-07) · logsource: product=windows category=process_creation · d06be4b9-8045-428b-a567-740a26d9db25
Detects when verclsid.exe is used to run COM object via GUID
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-07-01 (modified 2023-11-09) · logsource: product=windows category=process_creation · d22e2925-cfd8-463f-96f6-89cec9d9bc5f
Detects the execution of ".xbap" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious ".xbap" files any bypass AWL
Author: frack113
· 2022-05-07 (modified 2022-05-16) · logsource: product=windows category=process_creation · d3bf399f-b0cf-4250-8bb4-dfc192ab81dc
Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories
Author: Beyu Denis, oscd.community
· 2020-10-18 (modified 2025-10-08) · logsource: product=windows category=process_creation · d80d5c81-04ba-45b4-84e4-92eba40e0ad3
Detects execution of arbitrary DLLs or unsigned code via a ".csproj" files via Dotnet.EXE.
Author: Andreas Braathen (mnemonic.io)
· 2023-10-17 · logsource: product=windows category=process_creation · d81a9fc6-55db-4461-b962-0e78fea5b0ad
Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path.
Author: Ensar Şamil, @sblmsrsn, OSCD Community
· 2020-10-05 (modified 2022-12-25) · logsource: product=windows category=ps_script · dddfebae-c46f-439c-af7a-fdb6bde90218
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
Author: oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)
· 2020-10-05 (modified 2023-04-12) · logsource: product=windows category=process_creation · dec44ca7-61ad-493c-bfd7-8819c5faa09b
Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-02-05 · logsource: product=windows category=process_creation · dfa03a09-8b92-4d83-8e74-f72839b1c407
Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.
Author: frack113, omkar72, oscd.community, Wojciech Lesicki
· 2022-11-18 (modified 2023-02-23) · logsource: product=windows category=file_event · e0b06658-7d1d-4cd3-bf15-03467507ff7c
Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.
Author: Alejandro Houspanossian ('@lekz86')
· 2024-01-02 · logsource: product=windows category=process_creation · e5144106-8198-4f6e-bfc2-0a551cc8dd94
Detects the execution of concatenated commands via "cmd.exe". Pikabot often executes a combination of multiple commands via the command handler "cmd /c" in order to download and execute additional payloads.
Commands such as "curl", "wget" in order to download extra payloads. "ping" and "timeout" are abused to introduce delays in the command execution and "Rundll32" is also used to execute malicious DLL files.
In the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-03-29 · logsource: product=windows category=process_creation · e7581747-1e44-4d4b-85a6-0db0b4a00f2a
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software
Author: Ensar Şamil, @sblmsrsn, @oscd_initiative
· 2020-10-06 (modified 2022-12-02) · logsource: product=windows category=image_load · e76c8240-d68f-4773-8880-5c6f63595aaf
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Author: Swachchhanda Shrawan Poudel
· 2023-11-09 · logsource: product=windows category=process_creation · e84d89c4-f544-41ca-a6af-4b92fd38b023
Detects usage of "msedge_proxy.exe" to download arbitrary files
Author: Nasreddine Bencherchali (Nextron Systems), NCSC (Idea)
· 2023-05-15 (modified 2025-10-19) · logsource: product=windows category=process_creation · e8954be4-b2b8-4961-be18-da1a5bda709c
Detects specific process behavior observed with Devil Bait samples
Author: Maxim Pavlunin
· 2020-04-01 (modified 2023-04-12) · logsource: product=windows category=process_creation · e8a95b5e-c891-46e2-b33a-93937d3abc31
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Author: frack113, Florian Roth (Nextron Systems)
· 2022-08-21 (modified 2026-05-11) · logsource: product=windows category=file_event · f0540f7e-2db3-4432-b9e0-3965486744bc
Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk.
This may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.
Author: Mateusz Wydra, oscd.community
· 2020-10-12 (modified 2024-03-06) · logsource: product=windows category=process_creation · f24bcaea-0cd1-11eb-adc1-0242ac120002
Detects the start of a non built-in assistive technology applications via "Atbroker.EXE".
Author: frack113
· 2021-11-03 (modified 2024-04-22) · logsource: product=windows category=process_creation · f37aba28-a9e6-4045-882c-d5004043b337
Detects execution of Cmdl32 with the "/vpn" and "/lan" flags.
Attackers can abuse this utility in order to download arbitrary files via a configuration file.
Inspect the location and the content of the file passed as an argument in order to determine if it is suspicious.
Author: Nextron Systems, @Kostastsale
· 2022-06-01 (modified 2024-08-23) · logsource: product=windows category=process_creation · f3d39c45-de1a-4486-a687-ab126124f744
Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-07-13 (modified 2023-05-09) · logsource: product=windows service=powershell-classic · f65e22f9-819e-4f96-9c7b-498364ae7a25
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-08 · logsource: product=windows category=process_creation · f9999590-1f94-4a34-a91e-951e47bedefd
Detects suspicious child processes of "provlaunch.exe" which might indicate potential abuse to proxy execution.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-15 (modified 2024-03-05) · logsource: product=windows category=process_creation · fa1a7e52-3d02-435b-81b8-00da14dd66c1
Detects execution of "Diskshadow.exe" in script mode using the "/s" flag where the script is located in a potentially suspicious location.
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
· 2021-11-26 (modified 2024-08-26) · logsource: product=windows category=process_creation · fb0b815b-f5f6-4f50-970f-ffe21f253f7a
Detects the execution of "Extexport.exe".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa.
It can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll".
Arbitrary DLLs can also be loaded if a specific number of flags was provided.
Author: frack113
· 2021-07-12 (modified 2022-10-04) · logsource: product=windows category=process_creation · fbd7c32d-db2a-4418-b92c-566eb8911133
Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.
Author: oscd.community, Natalia Shornikova
· 2020-10-13 (modified 2023-08-17) · logsource: product=windows category=registry_set · fc014922-5def-4da9-a0fc-28c973f41bfb
This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.
Author: Ensar Şamil, @sblmsrsn, OSCD Community
· 2020-10-05 (modified 2022-12-02) · logsource: product=windows category=ps_module · fe5ce7eb-dad8-467c-84a9-31ec23bd644a
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.