{"id":"T1218","name":"System Binary Proxy Execution","url":"https://attack.mitre.org/techniques/T1218","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0081","stix_id":"x-mitre-detection-strategy--ce0b969a-1411-4b6f-a6aa-c31ef6fe6727","name":"Detection of Proxy Execution via Trusted Signed Binaries Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0081","analytics":[{"id":"AN0226","stix_id":"x-mitre-analytic--865c00d7-fc01-4ce6-8fc8-d7a84f2ded36","name":"Analytic 0226","description":"Execution of trusted, Microsoft-signed binaries such as `rundll32.exe`, `msiexec.exe`, or `regsvr32.exe` used to execute externally hosted, unsigned, or suspicious payloads through command-line parameters or network retrieval.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0226","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=3, 22","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"ParentProcessName","description":"Used to profile unexpected parent-child relationships (e.g., regsvr32.exe not launched by explorer.exe)"},{"field":"SignedBinaryList","description":"List of known signed binaries allowed for execution (e.g., msiexec.exe, regsvr32.exe)"},{"field":"CommandLineRegex","description":"Regex to match suspicious arguments, such as URLs, script paths, or DLL entrypoints"},{"field":"RemoteDomainAllowlist","description":"Filter to suppress activity contacting legitimate enterprise domains"}],"live":true,"detection_strategies":["DET0081"],"techniques":["T1218"]},{"id":"AN0227","stix_id":"x-mitre-analytic--273d7b27-6b7d-4017-a7f6-0cd02fd3a128","name":"Analytic 0227","description":"Execution of trusted system binaries (e.g., `split`, `tee`, `bash`, `env`) used in uncommon sequences or chained behaviors to execute malicious payloads or perform actions inconsistent with normal system or script behavior.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0227","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"connect","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"TrustedBinaryList","description":"Binaries like `split`, `tee`, `env`, `awk`, `gzip`, often used in benign scripts"},{"field":"AnomalyScore","description":"Outlier model for process tree and command arguments"}],"live":true,"detection_strategies":["DET0081"],"techniques":["T1218"]},{"id":"AN0228","stix_id":"x-mitre-analytic--3e461dab-922c-48cc-aafc-51f20025bf27","name":"Analytic 0228","description":"Use of system binaries such as `osascript`, `bash`, or `curl` to download or execute unsigned code or files in conjunction with application proxying.","url":"https://attack.mitre.org/detectionstrategies/DET0081#AN0228","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"exec of osascript, bash, curl with suspicious parameters","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"execution of trusted tools interacting with external endpoints","data_component":"DC0082","data_component_name":"Network Connection Creation","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"TrustedUtilityList","description":"macOS binary whitelist including `/usr/bin/osascript`, `/bin/bash`, `/usr/bin/curl`"},{"field":"SignedToUnsignedTransition","description":"Used to detect proxy execution from signed binary to unsigned payload"}],"live":true,"detection_strategies":["DET0081"],"techniques":["T1218"]}],"live":true,"version":"1.0","techniques":["T1218"]}],"sigma_rules":[{"id":"01c42d3c-242d-4655-85b2-34f1739632f7","title":"Potentially Over Permissive Permissions Granted Using Dsacls.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-02-04","description":"Detects usage of Dsacls to grant over permissive permissions","references":["https://ss64.com/nt/dsacls.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dsacls_abuse_permissions.yml","techniques":["T1218"],"cves":[]},{"id":"02b18447-ea83-4b1b-8805-714a8a34546a","title":"Potential Mpclient.DLL Sideloading Via OfflineScannerShell.EXE Execution","author":"frack113","status":"test","level":"medium","date":"2022-03-06","modified":"2023-08-03","description":"Detects execution of Windows Defender \"OfflineScannerShell.exe\" from its non standard directory.\nThe \"OfflineScannerShell.exe\" binary is vulnerable to DLL side loading and will load any DLL named \"mpclient.dll\" from the current working directory.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/OfflineScannerShell/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_offlinescannershell_mpclient_sideloading.yml","techniques":["T1218"],"cves":[]},{"id":"04936b66-3915-43ad-a8e5-809eadfd1141","title":"Insensitive Subfolder Search Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of findstr with the \"s\" and \"i\" flags for a \"subfolder\" and \"insensitive\" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_subfolder_search.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"04fc4b22-91a6-495a-879d-0144fec5ec03","title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Image Load","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-13","modified":null,"description":"Detects potential exploitation of remote code execution vulnerability CVE-2025-33053\nby monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from\nattacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.\n","references":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053","https://research.checkpoint.com/2025/stealth-falcon-zero-day/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1218","attack.lateral-movement","attack.t1105","detection.emerging-threats","cve.2025-33053"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/image_load_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"],"cves":["CVE-2025-33053"]},{"id":"0b4ae027-2a2d-4b93-8c7e-962caaba5b2a","title":"Time Travel Debugging Utility Usage","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","status":"test","level":"high","date":"2020-10-06","modified":"2022-10-09","description":"Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.","references":["https://lolbas-project.github.io/lolbas/Binaries/Tttracer/","https://twitter.com/mattifestation/status/1196390321783025666","https://twitter.com/oulusoyum/status/1191329746069655553"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1218","attack.t1003.001"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_tttracer_mod_load.yml","techniques":["T1218","T1003.001"],"cves":[]},{"id":"0bbc6369-43e3-453d-9944-cae58821c173","title":"Execution via WorkFolders.exe","author":"Maxime Thiebaut (@0xThiebaut)","status":"test","level":"high","date":"2021-10-21","modified":"2022-12-25","description":"Detects using WorkFolders.exe to execute an arbitrary control.exe","references":["https://twitter.com/elliotkillick/status/1449812843772227588"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_workfolders.yml","techniques":["T1218"],"cves":[]},{"id":"0c2f8629-7129-4a8a-9897-7e0768f13ff2","title":"Diskshadow Script Mode Execution","author":"Ivan Dyachkov, oscd.community","status":"test","level":"medium","date":"2020-10-07","modified":"2024-03-13","description":"Detects execution of \"Diskshadow.exe\" in script mode using the \"/s\" flag. Attackers often abuse \"diskshadow\" to execute scripts that deleted the shadow copies on the systems. Investigate the content of the scripts and its location.\n","references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_script_mode.yml","techniques":["T1218"],"cves":[]},{"id":"0fa66f66-e3f6-4a9c-93f8-4f2610b00171","title":"Potential DLL Sideloading Using Coregen.exe","author":"frack113","status":"test","level":"medium","date":"2022-12-31","modified":null,"description":"Detect usage of the \"coregen.exe\" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Coregen/"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1218","attack.t1055"],"path":"rules/windows/image_load/image_load_side_load_coregen.yml","techniques":["T1218","T1055"],"cves":[]},{"id":"104cdb48-a7a8-4ca7-a453-32942c6e5dcb","title":"File Download Using ProtocolHandler.exe","author":"frack113","status":"test","level":"medium","date":"2021-07-13","modified":"2023-11-09","description":"Detects usage of \"ProtocolHandler\" to download files. Downloaded files will be located in the cache folder (for example - %LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE)\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://lolbas-project.github.io/lolbas/OtherMSBinaries/ProtocolHandler/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_protocolhandler_download.yml","techniques":["T1218"],"cves":[]},{"id":"15c7904e-6ad1-4a45-9b46-5fb25df37fd2","title":"Malicious PE Execution by Microsoft Visual Studio Debugger","author":"Agro (@agro_sev), Ensar Şamil (@sblmsrsn), oscd.community","status":"test","level":"medium","date":"2020-10-14","modified":"2022-10-09","description":"There is an option for a MS VS Just-In-Time Debugger \"vsjitdebugger.exe\" to launch specified executable and attach a debugger.\nThis option may be used adversaries to execute malicious code by signed verified binary.\nThe debugger is installed alongside with Microsoft Visual Studio package.\n","references":["https://twitter.com/pabraeken/status/990758590020452353","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vsjitdebugger/","https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_use_of_vsjitdebugger_bin.yml","techniques":["T1218"],"cves":[]},{"id":"180c7c5c-d64b-4a63-86e9-68910451bc8b","title":"Potential File Download Via MS-AppInstaller Protocol Handler","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2023-11-09","modified":null,"description":"Detects usage of the \"ms-appinstaller\" protocol handler via command line to potentially download arbitrary files via AppInstaller.EXE\nThe downloaded files are temporarly stored in \":\\Users\\%username%\\AppData\\Local\\Packages\\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\\AC\\INetCache\\<RANDOM-8-CHAR-DIRECTORY>\"\n","references":["https://lolbas-project.github.io/lolbas/Binaries/AppInstaller/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_ms_appinstaller_download.yml","techniques":["T1218"],"cves":[]},{"id":"1c8774a0-44d4-4db0-91f8-e792359c70bd","title":"REGISTER_APP.VBS Proxy Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":null,"description":"Detects the use of a Microsoft signed script 'REGISTER_APP.VBS' to register a VSS/VDS Provider as a COM+ application.","references":["https://twitter.com/sblmsrsn/status/1456613494783160325?s=20"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_register_app.yml","techniques":["T1218"],"cves":[]},{"id":"1cf465a1-2609-4c15-9b66-c32dbe4bfd67","title":"Legitimate Application Writing Files In Uncommon Location","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-12-10","modified":null,"description":"Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.\nAdversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.\n","references":["https://lolbas-project.github.io/#/download"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_in_uncommon_location.yml","techniques":["T1218","T1105"],"cves":[]},{"id":"1d174d38-8fda-4081-a9b6-56d9763c0cd8","title":"Scheduled Task Creation with Curl and PowerShell Execution Combo","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-02-05","modified":null,"description":"Detects the creation of a scheduled task using schtasks.exe, potentially in combination with curl for downloading payloads and PowerShell for executing them.\nThis facilitates executing malicious payloads or connecting with C&C server persistently without dropping the malware sample on the host.\n","references":["https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.stealth","attack.t1053.005","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_curl_and_powershell_combo.yml","techniques":["T1053.005","T1218","T1105"],"cves":[]},{"id":"1dd05363-104e-4b4a-b963-196a534b03a1","title":"Potentially Suspicious Mofcomp Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-07-12","modified":"2026-08-06","description":"Detects execution of the \"mofcomp\" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.\nThe \"mofcomp\" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.\nAttackers abuse this utility to install malicious MOF scripts\n","references":["https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/","https://github.com/The-DFIR-Report/Sigma-Rules/blob/75260568a7ffe61b2458ca05f6f25914efb44337/win_mofcomp_execution.yml","https://learn.microsoft.com/en-us/windows/win32/wmisdk/mofcomp"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_mofcomp_execution.yml","techniques":["T1218"],"cves":[]},{"id":"1dde5376-a648-492e-9e54-4241dd9b0c7f","title":"Diskshadow Script Mode - Uncommon Script Extension Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-15","modified":"2024-03-05","description":"Detects execution of \"Diskshadow.exe\" in script mode to execute an script with a potentially uncommon extension.\nInitial baselining of the allowed extension list is required.\n","references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow","https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf","https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware","https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_ext.yml","techniques":["T1218"],"cves":[]},{"id":"1e59c230-6670-45bf-83b0-98903780607e","title":"Gpscript Execution","author":"frack113","status":"test","level":"medium","date":"2022-05-16","modified":"2023-06-14","description":"Detects the execution of the LOLBIN gpscript, which executes logon or startup scripts configured in Group Policy","references":["https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/","https://lolbas-project.github.io/lolbas/Binaries/Gpscript/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_gpscript.yml","techniques":["T1218"],"cves":[]},{"id":"1e75c1cc-c5d4-42aa-ac3d-91b0b68b3b4c","title":"Arbitrary File Download Via Squirrel.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2022-06-09","modified":"2023-11-09","description":"Detects the usage of the \"Squirrel.exe\" to download arbitrary files. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/","http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_squirrel_download.yml","techniques":["T1218"],"cves":[]},{"id":"21dd6d38-2b18-4453-9404-a0fe4a0cc288","title":"Curl Download And Execute Combination","author":"Sreeman, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-13","modified":"2024-03-05","description":"Adversaries can use curl to download payloads remotely and execute them. Curl is included by default in Windows 10 build 17063 and later.","references":["https://medium.com/@reegun/curl-exe-is-the-new-rundll32-exe-lolbin-3f79c5f35983"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_cmd_curl_download_exec_combo.yml","techniques":["T1218","T1105"],"cves":[]},{"id":"222720a7-047f-4054-baa5-bab9be757db0","title":"PowerShell MSI Install via WindowsInstaller COM From Remote Location","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"medium","date":"2025-06-05","modified":null,"description":"Detects the execution of PowerShell commands that attempt to install MSI packages via the\nWindows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\nThis could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\nAnd the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\n","references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml","techniques":["T1059.001","T1218","T1105"],"cves":[]},{"id":"2267fe65-0681-42ad-9a6d-46553d3f3480","title":"WSL Child Process Anomaly","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-23","modified":"2023-08-15","description":"Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/","https://twitter.com/nas_bench/status/1535431474429808642"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_wsl_child_processes_anomalies.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"242301bc-f92f-4476-8718-78004a6efd9f","title":"DLL Loaded via CertOC.EXE","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-10-23","modified":"2024-03-05","description":"Detects when a user installs certificates by using CertOC.exe to loads the target DLL file.","references":["https://twitter.com/sblmsrsn/status/1445758411803480072?s=20","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2","https://lolbas-project.github.io/lolbas/Binaries/Certoc/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_certoc_load_dll.yml","techniques":["T1218"],"cves":[]},{"id":"28c8f68b-098d-45af-8d43-8089f3e35403","title":"Potential Register_App.Vbs LOLScript Abuse","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-05","modified":"2022-07-07","description":"Detects potential abuse of the \"register_app.vbs\" script that is part of the Windows SDK. The script offers the capability to register new VSS/VDS Provider as a COM+ application. Attackers can use this to install malicious DLLs for persistence and execution.","references":["https://twitter.com/sblmsrsn/status/1456613494783160325?s=20","https://github.com/microsoft/Windows-classic-samples/blob/7cbd99ac1d2b4a0beffbaba29ea63d024ceff700/Samples/Win7Samples/winbase/vss/vsssampleprovider/register_app.vbs"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolscript_register_app.yml","techniques":["T1218"],"cves":[]},{"id":"2a4b3e61-9d22-4e4a-b60f-6e8f0cde6f25","title":"Potential Provisioning Registry Key Abuse For Binary Proxy Execution","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-08-08","modified":null,"description":"Detects potential abuse of the provisioning registry key for indirect command execution through \"Provlaunch.exe\".","references":["https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/","https://twitter.com/0gtweet/status/1674399582162153472"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_registry_provlaunch_provisioning_command.yml","techniques":["T1218"],"cves":[]},{"id":"2fcda7e2-8c57-4904-86ac-37fc3157e09d","title":"Sensitive File Dump Via Print.EXE","author":"Ayush Anand (Securityinbits)","status":"test","level":"high","date":"2026-04-28","modified":null,"description":"Detects the abuse of the Print.exe utility for credential harvesting which involves using Print.Exe to copy sensitive files such as ntds.dit, SAM, SECURITY, or SYSTEM from the Windows directory in order to extract credentials, locally or remotely.\n","references":["https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/","https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2","https://lolbas-project.github.io/lolbas/Binaries/Print/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.stealth","attack.t1003.003","attack.t1003.002","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_print_dump_sensitive_files.yml","techniques":["T1003.003","T1003.002","T1218"],"cves":[]},{"id":"340a090b-c4e9-412e-bb36-b4b16fe96f9b","title":"Renamed ZOHO Dctask64 Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-01-28","modified":"2025-01-22","description":"Detects a renamed \"dctask64.exe\" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.\nThis binary can be abused for DLL injection, arbitrary command and process execution.\n","references":["https://twitter.com/gN3mes1s/status/1222088214581825540","https://twitter.com/gN3mes1s/status/1222095963789111296","https://twitter.com/gN3mes1s/status/1222095371175911424"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1036","attack.t1055.001","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_dctask64.yml","techniques":["T1036","T1055.001","T1202","T1218"],"cves":[]},{"id":"36475a7d-0f6d-4dce-9b01-6aeb473bbaf1","title":"SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code","author":"frack113","status":"test","level":"medium","date":"2021-07-16","modified":"2022-06-22","description":"Executes arbitrary PowerShell code using SyncAppvPublishingServer.vbs","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1216/T1216.md","https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh.yml","techniques":["T1218","T1216"],"cves":[]},{"id":"38a7625e-b2cb-485d-b83d-aff137d859f4","title":"Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2021-07-13","modified":"2023-05-09","description":"Detects PowerShell module creation where the module Contents are set to \"function Get-VMRemoteFXPhysicalVideoAdapter\". This could be a sign of potential abuse of the \"RemoteFXvGPUDisablement.exe\" binary which is known to be vulnerable to module load-order hijacking.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/powershell/powershell_module/posh_pm_remotefxvgpudisablement_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","title":"Windows Shell/Scripting Processes Spawning Suspicious Programs","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2018-04-06","modified":"2023-05-23","description":"Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.","references":["https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.001","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","techniques":["T1059.005","T1059.001","T1218"],"cves":[]},{"id":"3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe","title":"Hidden Flag Set On File/Directory Via Chflags - MacOS","author":"Omar Khaled (@beacon_exe)","status":"test","level":"medium","date":"2024-08-21","modified":null,"description":"Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\nWhen a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\n","references":["https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf","https://ss64.com/mac/chflags.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"3b3c7f55-f771-4dd6-8a6e-08d057a17caf","title":"Arbitrary File Download Via MSPUB.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":"2023-02-08","description":"Detects usage of \"MSPUB\" (Microsoft Publisher) to download arbitrary files","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/238/files"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_mspub_download.yml","techniques":["T1218"],"cves":[]},{"id":"409f8a98-4496-4aaa-818a-c931c0a8b832","title":"Created Files by Microsoft Sync Center","author":"elhoim","status":"test","level":"medium","date":"2022-04-28","modified":"2022-06-02","description":"This rule detects suspicious files created by Microsoft Sync Center (mobsync)","references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1218","attack.execution"],"path":"rules/windows/file/file_event/file_event_win_susp_creation_by_mobsync.yml","techniques":["T1055","T1218"],"cves":[]},{"id":"40b95d31-1afc-469e-8d34-9a3a667d058e","title":"Suspicious Csi.exe Usage","author":"Konstantin Grishchenko, oscd.community","status":"test","level":"medium","date":"2020-10-17","modified":"2022-07-11","description":"Csi.exe is a signed binary from Microsoft that comes with Visual Studio and provides C# interactive capabilities. It can be used to run C# code from a file passed as a parameter in command line. Early version of this utility provided with Microsoft “Roslyn” Community Technology Preview was named 'rcsi.exe'","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Rcsi/","https://enigma0x3.net/2016/11/21/bypassing-application-whitelisting-by-using-rcsi-exe/","https://twitter.com/Z3Jpa29z/status/1317545798981324801"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.execution","attack.stealth","attack.t1072","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_csi_execution.yml","techniques":["T1072","T1218"],"cves":[]},{"id":"419dbf2b-8a9b-4bea-bf99-7544b050ec8d","title":"Microsoft Workflow Compiler Execution","author":"Nik Seetharaman, frack113","status":"test","level":"medium","date":"2019-01-16","modified":"2023-02-03","description":"Detects the execution of Microsoft Workflow Compiler, which may permit the execution of arbitrary unsigned code.\n","references":["https://posts.specterops.io/arbitrary-unsigned-code-execution-vector-in-microsoft-workflow-compiler-exe-3d9294bc5efb","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://lolbas-project.github.io/lolbas/Binaries/Microsoft.Workflow.Compiler/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1127","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution.yml","techniques":["T1127","T1218"],"cves":[]},{"id":"43103702-5886-11ed-9b6a-0242ac120002","title":"Suspicious Vsls-Agent Command With AgentExtensionPath Load","author":"bohops","status":"test","level":"medium","date":"2022-10-30","modified":null,"description":"Detects Microsoft Visual Studio vsls-agent.exe lolbin execution with a suspicious library load using the --agentExtensionPath parameter","references":["https://twitter.com/bohops/status/1583916360404729857"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_vslsagent_agentextensionpath_load.yml","techniques":["T1218"],"cves":[]},{"id":"45239e6a-b035-4aaf-b339-8ad379fcb67e","title":"Process Proxy Execution Via Squirrel.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Karneades / Markus Neis, Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2022-06-09","modified":"2025-10-07","description":"Detects the usage of the \"Squirrel.exe\" binary to execute arbitrary processes. This binary is part of multiple Electron based software installations (Slack, Teams, Discord, etc.)\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Squirrel/","http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/","http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_squirrel_proxy_execution.yml","techniques":["T1218"],"cves":[]},{"id":"459f2f98-397b-4a4a-9f47-6a5ec2f1c69d","title":"Arbitrary File Download Via MSOHTMED.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":"2023-11-09","description":"Detects usage of \"MSOHTMED\" to download arbitrary files","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/238/files"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_msohtmed_download.yml","techniques":["T1218"],"cves":[]},{"id":"46123129-1024-423e-9fae-43af4a0fa9a5","title":"File Download Via Windows Defender MpCmpRun.EXE","author":"Matthew Matchen","status":"test","level":"high","date":"2020-09-04","modified":"2023-11-09","description":"Detects the use of Windows Defender MpCmdRun.EXE to download files","references":["https://web.archive.org/web/20200903194959/https://twitter.com/djmtshepana/status/1301608169496612866","https://lolbas-project.github.io/lolbas/Binaries/MpCmdRun/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_mpcmdrun_download_arbitrary_file.yml","techniques":["T1218","T1105"],"cves":[]},{"id":"4f2cd9b6-4a17-440f-bb2a-687abb65993a","title":"Uncommon AddinUtil.EXE CommandLine Execution","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","status":"test","level":"medium","date":"2023-09-18","modified":null,"description":"Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with uncommon Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.\n","references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_addinutil_uncommon_cmdline.yml","techniques":["T1218"],"cves":[]},{"id":"5205613d-2a63-4412-a895-3a2458b587b3","title":"Network Connection Initiated By AddinUtil.EXE","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","status":"test","level":"high","date":"2023-09-18","modified":"2024-07-16","description":"Detects a network connection initiated by the Add-In deployment cache updating utility \"AddInutil.exe\".\nThis could indicate a potential command and control communication as this tool doesn't usually initiate network activity.\n","references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/network_connection/net_connection_win_addinutil_initiated.yml","techniques":["T1218"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"53d4bb30-3f36-4e8a-b078-69d36c4a79ff","title":"COM Object Execution via Xwizard.EXE","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-07","modified":"2024-08-15","description":"Detects the execution of Xwizard tool with the \"RunWizard\" flag and a GUID like argument.\nThis utility can be abused in order to run custom COM object created in the registry.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Xwizard/","https://www.elastic.co/guide/en/security/current/execution-of-com-object-via-xwizard.html","https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_xwizard_runwizard_com_object_exec.yml","techniques":["T1218"],"cves":[]},{"id":"53d8d3e1-ca33-4012-adf3-e05a4d652e34","title":"Process Memory Dump Via Dotnet-Dump","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-03-14","modified":null,"description":"Detects the execution of \"dotnet-dump\" with the \"collect\" flag. The execution could indicate potential process dumping of critical processes such as LSASS.\n","references":["https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dump-collect","https://twitter.com/bohops/status/1635288066909966338"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dotnetdump_memory_dump.yml","techniques":["T1218"],"cves":[]},{"id":"5594e67a-7f92-4a04-b65d-1a42fd824a60","title":"MSI Installation From Web","author":"Stamatis Chatzimangou","status":"test","level":"medium","date":"2022-10-23","modified":null,"description":"Detects installation of a remote msi file from web.","references":["https://twitter.com/_st0pp3r_/status/1583922009842802689"],"logsource":{"product":"windows","service":"application"},"tags":["attack.stealth","attack.t1218","attack.t1218.007"],"path":"rules/windows/builtin/application/msiinstaller/win_msi_install_from_web.yml","techniques":["T1218","T1218.007"],"cves":[]},{"id":"56b1dde8-b274-435f-a73a-fb75eb81262a","title":"Diskshadow Child Process Spawned","author":"Harjot Singh @cyb3rjy0t","status":"test","level":"medium","date":"2023-09-15","modified":null,"description":"Detects any child process spawning from \"Diskshadow.exe\". This could be due to executing Diskshadow in interpreter mode or script mode and using the \"exec\" flag to launch other applications.","references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_diskshadow_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"587254ee-a24b-4335-b3cd-065c0f1f4baa","title":"Remote File Download Via Findstr.EXE","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-05","modified":"2024-03-05","description":"Detects execution of \"findstr\" with specific flags and a remote share path. This specific set of CLI flags would allow \"findstr\" to download the content of the file located on the remote share as described in the LOLBAS entry.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Findstr/","https://oddvar.moe/2018/04/11/putting-data-in-alternate-data-streams-and-how-to-execute-it-part-2/","https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_findstr_download.yml","techniques":["T1218","T1564.004","T1552.001","T1105"],"cves":[]},{"id":"5a3164f2-b373-4152-93cf-090b13c12d27","title":"Potentially Suspicious Child Process Of VsCode","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-26","modified":"2023-10-25","description":"Detects uncommon or suspicious child processes spawning from a VsCode \"code.exe\" process. This could indicate an attempt of persistence via VsCode tasks or terminal profiles.","references":["https://twitter.com/nas_bench/status/1618021838407495681","https://twitter.com/nas_bench/status/1618021415852335105"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_vscode_child_processes_anomalies.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"6004abd0-afa4-4557-ba90-49d172e0a299","title":"Execute Pcwrun.EXE To Leverage Follina","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-13","modified":null,"description":"Detects indirect command execution via Program Compatibility Assistant \"pcwrun.exe\" leveraging the follina (CVE-2022-30190) vulnerability","references":["https://twitter.com/nas_bench/status/1535663791362519040"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pcwrun_follina.yml","techniques":["T1218"],"cves":[]},{"id":"60f16a96-db70-42eb-8f76-16763e333590","title":"New Capture Session Launched Via DXCap.EXE","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-26","modified":"2022-06-09","description":"Detects the execution of \"DXCap.EXE\" with the \"-c\" flag, which allows a user to launch any arbitrary binary or windows package through DXCap itself. This can be abused to potentially bypass application whitelisting.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dxcap/","https://twitter.com/harr0ey/status/992008180904419328"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dxcap_arbitrary_binary_execution.yml","techniques":["T1218"],"cves":[]},{"id":"6120ac2a-a34b-42c0-a9bd-1fb9f459f348","title":"AddinUtil.EXE Execution From Uncommon Directory","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","status":"test","level":"medium","date":"2023-09-18","modified":"2025-02-24","description":"Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) from a non-standard directory.","references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_addinutil_uncommon_dir_exec.yml","techniques":["T1218"],"cves":[]},{"id":"631b22a4-70f4-4e2f-9ea8-42f84d9df6d8","title":"Suspicious AddinUtil.EXE CommandLine Execution","author":"Nasreddine Bencherchali (Nextron Systems), Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","status":"test","level":"high","date":"2023-09-18","modified":null,"description":"Detects execution of the Add-In deployment cache updating utility (AddInutil.exe) with suspicious Addinroot or Pipelineroot paths. An adversary may execute AddinUtil.exe with uncommon Addinroot/Pipelineroot paths that point to the adversaries Addins.Store payload.\n","references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_addinutil_suspicious_cmdline.yml","techniques":["T1218"],"cves":[]},{"id":"634b00d5-ccc3-4a06-ae3b-0ec8444dd51b","title":"Malicious Windows Script Components File Execution by TAEF Detection","author":"Agro (@agro_sev) oscd.community","status":"test","level":"low","date":"2020-10-13","modified":"2021-11-27","description":"Windows Test Authoring and Execution Framework (TAEF) framework allows you to run automation by executing tests files written on different languages (C, C#, Microsoft COM Scripting interfaces\nAdversaries may execute malicious code (such as WSC file with VBScript, dll and so on) directly by running te.exe\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Te/","https://twitter.com/pabraeken/status/993298228840992768","https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_use_of_te_bin.yml","techniques":["T1218"],"cves":[]},{"id":"63f3605b-979f-48c2-b7cc-7f90523fed88","title":"Potential Suspicious Child Process Of 3CXDesktopApp","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-03-29","modified":null,"description":"Detects potential suspicious child processes of \"3CXDesktopApp.exe\". Which could be related to the 3CXDesktopApp supply chain compromise","references":["https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/","https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1218","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_children.yml","techniques":["T1218"],"cves":[]},{"id":"643bdcac-8b82-49f4-9fd9-25a90b929f3b","title":"Renamed MegaSync Execution","author":"Sittikorn S","status":"test","level":"high","date":"2021-06-22","modified":"2023-02-03","description":"Detects the execution of a renamed MegaSync.exe as seen used by ransomware families like Nefilim, Sodinokibi, Pysa, and Conti.","references":["https://redcanary.com/blog/rclone-mega-extortion/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_megasync.yml","techniques":["T1218"],"cves":[]},{"id":"646bc99f-6682-4b47-a73a-17b1b64c9d34","title":"Execute Files with Msdeploy.exe","author":"Beyu Denis, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2021-11-27","description":"Detects file execution using the msdeploy.exe lolbin","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/","https://twitter.com/pabraeken/status/995837734379032576","https://twitter.com/pabraeken/status/999090532839313408"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_msdeploy.yml","techniques":["T1218"],"cves":[]},{"id":"64760eef-87f7-4ed3-93fd-655668ea9420","title":"Use of Scriptrunner.exe","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-01","modified":null,"description":"The \"ScriptRunner.exe\" binary can be abused to proxy execution through it and bypass possible whitelisting","references":["https://lolbas-project.github.io/lolbas/Binaries/Scriptrunner/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_scriptrunner.yml","techniques":["T1218"],"cves":[]},{"id":"654fcc6d-840d-4844-9b07-2c3300e54a26","title":"Legitimate Application Dropped Archive","author":"frack113, Florian Roth","status":"test","level":"high","date":"2022-08-21","modified":null,"description":"Detects programs on a Windows system that should not write an archive to disk","references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_archive.yml","techniques":["T1218"],"cves":[]},{"id":"65c3ca2c-525f-4ced-968e-246a713d164f","title":"Visual Studio NodejsTools PressAnyKey Renamed Execution","author":"Nasreddine Bencherchali (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2023-04-11","modified":null,"description":"Detects renamed execution of \"Microsoft.NodejsTools.PressAnyKey.exe\", which can be abused as a LOLBIN to execute arbitrary binaries","references":["https://twitter.com/mrd0x/status/1463526834918854661","https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_renamed_pressanykey.yml","techniques":["T1218"],"cves":[]},{"id":"6c6d9280-e6d0-4b9d-80ac-254701b64916","title":"Potential NTLM Coercion Via Certutil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-01","modified":"2023-02-14","description":"Detects possible NTLM coercion via certutil using the 'syncwithWU' flag","references":["https://github.com/LOLBAS-Project/LOLBAS/issues/243"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_certutil_ntlm_coercion.yml","techniques":["T1218"],"cves":[]},{"id":"6e8fe0a8-ba0b-4a93-8f9e-82657e7a5984","title":"BaaUpdate.exe Suspicious DLL Load","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-18","modified":null,"description":"Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious locations that are publicly writable which could indicate an attempt to lateral movement via BitLocker DCOM & COM Hijacking.\nThis technique abuses COM Classes configured as INTERACTIVE USER to spawn processes in the context of the logged-on user's session. Specifically, it targets the BDEUILauncher Class (CLSID ab93b6f1-be76-4185-a488-a9001b105b94)\nwhich can launch BaaUpdate.exe, which is vulnerable to COM Hijacking when started with input parameters. This allows attackers to execute code in the user's context without needing to steal credentials or use additional techniques to compromise the account.\n","references":["https://github.com/rtecCyberSec/BitlockMove"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.stealth","attack.t1218","attack.lateral-movement","attack.t1021.003"],"path":"rules/windows/image_load/image_load_susp_baaupdate_dll_load.yml","techniques":["T1218","T1021.003"],"cves":[]},{"id":"6e968eb1-5f05-4dac-94e9-fd0c5cb49fd6","title":"Uncommon Link.EXE Parent Process","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-22","modified":"2024-06-27","description":"Detects an uncommon parent process of \"LINK.EXE\".\nLink.EXE in Microsoft incremental linker. Its a utility usually bundled with Visual Studio installation.\nMultiple utilities often found in the same folder (editbin.exe, dumpbin.exe, lib.exe, etc) have a hardcode call to the \"LINK.EXE\" binary without checking its validity.\nThis would allow an attacker to sideload any binary with the name \"link.exe\" if one of the aforementioned tools get executed from a different location.\nBy filtering the known locations of such utilities we can spot uncommon parent process of LINK.EXE that might be suspicious or malicious.\n","references":["https://twitter.com/0gtweet/status/1560732860935729152"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_link_uncommon_parent_process.yml","techniques":["T1218"],"cves":[]},{"id":"6f535e01-ca1f-40be-ab8d-45b19c0c8b7f","title":"Import LDAP Data Interchange Format File Via Ldifde.EXE","author":"@gott_cyber","status":"test","level":"medium","date":"2022-09-02","modified":"2023-03-14","description":"Detects the execution of \"Ldifde.exe\" with the import flag \"-i\". The can be abused to include HTTP-based arguments which will allow the arbitrary download of files from a remote server.\n","references":["https://twitter.com/0gtweet/status/1564968845726580736","https://strontic.github.io/xcyclopedia/library/ldifde.exe-979DE101F5059CEC1D2C56967CA2BAC0.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.stealth","attack.t1218","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_ldifde_file_load.yml","techniques":["T1218","T1105"],"cves":[]},{"id":"7021255e-5db3-4946-a8b9-0ba7a4644a69","title":"Potential Provisioning Registry Key Abuse For Binary Proxy Execution - REG","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-08-02","modified":"2023-08-17","description":"Detects potential abuse of the provisioning registry key for indirect command execution through \"Provlaunch.exe\".","references":["https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/","https://twitter.com/0gtweet/status/1674399582162153472"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/registry/registry_set/registry_set_provisioning_command_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"727454c0-d851-48b0-8b89-385611ab0704","title":"Lolbin Unregmp2.exe Use As Proxy","author":"frack113","status":"test","level":"medium","date":"2022-12-29","modified":"2024-06-04","description":"Detect usage of the \"unregmp2.exe\" binary as a proxy to launch a custom version of \"wmpnscfg.exe\"","references":["https://lolbas-project.github.io/lolbas/Binaries/Unregmp2/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_unregmp2.yml","techniques":["T1218"],"cves":[]},{"id":"729ce0ea-5d8f-4769-9762-e35de441586d","title":"MpiExec Lolbin","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-01-11","modified":"2024-11-23","description":"Detects a certain command line flag combination used by mpiexec.exe LOLBIN from HPC pack that can be used to execute any other binary","references":["https://twitter.com/mrd0x/status/1465058133303246867","https://learn.microsoft.com/en-us/powershell/high-performance-computing/mpiexec?view=hpc19-ps"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_mpiexec.yml","techniques":["T1218"],"cves":[]},{"id":"75edd216-1939-4c73-8d61-7f3a0d85b5cc","title":"File Download Via InstallUtil.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":"2023-11-09","description":"Detects use of .NET InstallUtil.exe in order to download arbitrary files. The files will be written to \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\\"\n","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/239"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_installutil_download.yml","techniques":["T1218"],"cves":[]},{"id":"760e75d8-c3b5-409b-a9bf-6130b4c4603f","title":"Self Extraction Directive File Created In Potentially Suspicious Location","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-02-05","modified":null,"description":"Detects the creation of Self Extraction Directive files (.sed) in a potentially suspicious location.\nThese files are used by the \"iexpress.exe\" utility in order to create self extracting packages.\nAttackers were seen abusing this utility and creating PE files with embedded \".sed\" entries.\n","references":["https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html","https://en.wikipedia.org/wiki/IExpress","https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_event/file_event_win_sed_file_creation.yml","techniques":["T1218"],"cves":[]},{"id":"78f10490-f2f4-4d19-a75b-4e0683bf3b8d","title":"Suspicious Speech Runtime Binary Child Process","author":"andrewdanis","status":"experimental","level":"high","date":"2025-10-23","modified":null,"description":"Detects suspicious Speech Runtime Binary Execution by monitoring its child processes.\nChild processes spawned by SpeechRuntime.exe could indicate an attempt for lateral movement via COM & DCOM hijacking.\n","references":["https://github.com/rtecCyberSec/SpeechRuntimeMove"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.stealth","attack.t1021.003","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_speechruntime_child_process.yml","techniques":["T1021.003","T1218"],"cves":[]},{"id":"7a74da6b-ea76-47db-92cc-874ad90df734","title":"Suspicious MSDT Parent Process","author":"Nextron Systems","status":"test","level":"high","date":"2022-06-01","modified":"2023-02-06","description":"Detects msdt.exe executed by a suspicious parent as seen in CVE-2022-30190 / Follina exploitation","references":["https://twitter.com/nao_sec/status/1530196847679401984","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_msdt_susp_parent.yml","techniques":["T1036","T1218"],"cves":[]},{"id":"7cce6fc8-a07f-4d84-a53e-96e1879843c9","title":"Potential Binary Impersonating Sysinternals Tools","author":"frack113, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"test","level":"medium","date":"2021-12-20","modified":"2025-04-12","description":"Detects binaries that use the same name as legitimate sysinternals tools to evade detection.\nThis rule looks for the execution of binaries that are named similarly to Sysinternals tools.\nAdversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.\n","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202","attack.t1036.005"],"path":"rules/windows/process_creation/proc_creation_win_sysinternals_tools_masquerading.yml","techniques":["T1218","T1202","T1036.005"],"cves":[]},{"id":"7d604714-e071-49ff-8726-edeb95a70679","title":"Legitimate Application Dropped Script","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2026-05-11","description":"Detects LOLBINs and applications that should not legitimately drop script files to disk.\nThis may indicate malware staging or abuse of a trusted binary for script-based code execution.\n","references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326","https://dmpdump.github.io/posts/TelegramRat/","https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_script.yml","techniques":["T1218"],"cves":[]},{"id":"7d6d30b8-5b91-4b90-a891-46cccaf29598","title":"Program Executed Using Proxy/Local Command Via SSH.EXE","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-12-29","modified":"2025-10-16","description":"Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs.","references":["https://lolbas-project.github.io/lolbas/Binaries/Ssh/","https://github.com/LOLBAS-Project/LOLBAS/pull/211/files","https://gtfobins.github.io/gtfobins/ssh/","https://man.openbsd.org/ssh_config#ProxyCommand","https://man.openbsd.org/ssh_config#LocalCommand"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml","techniques":["T1218"],"cves":[]},{"id":"7efd2c8d-8b18-45b7-947d-adfe9ed04f61","title":"AgentExecutor PowerShell Execution","author":"Nasreddine Bencherchali (Nextron Systems), memory-shards","status":"test","level":"medium","date":"2022-12-24","modified":"2024-08-07","description":"Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy \"Bypass\" or any binary named \"powershell.exe\" located in the path provided by 6th positional argument","references":["https://twitter.com/lefterispan/status/1286259016436514816","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/","https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension","https://twitter.com/jseerden/status/1247985304667066373/photo/1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_agentexecutor_potential_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"7f2376f9-42ee-4dfc-9360-fecff9a88fc8","title":"BitLockerTogo.EXE Execution","author":"Josh Nickels, mttaggart","status":"test","level":"low","date":"2024-07-11","modified":null,"description":"Detects the execution of \"BitLockerToGo.EXE\".\nBitLocker To Go is BitLocker Drive Encryption on removable data drives. This feature includes the encryption of, USB flash drives, SD cards, External hard disk drives, Other drives that are formatted by using the NTFS, FAT16, FAT32, or exFAT file system.\nThis is a rarely used application and usage of it at all is worth investigating.\nMalware such as Lumma stealer has been seen using this process as a target for process hollowing.\n","references":["https://tria.ge/240521-ynezpagf56/behavioral1","https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091","https://bazaar.abuse.ch/sample/8c75f8e94486f5bbf461505823f5779f328c5b37f1387c18791e0c21f3fdd576/","https://bazaar.abuse.ch/sample/64e6605496919cd76554915cbed88e56fdec10dec6523918a631754664b8c8d3/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_bitlockertogo_execution.yml","techniques":["T1218"],"cves":[]},{"id":"7f5d1c9a-3e83-48df-95a7-2b98aae6c13c","title":"Potential Provlaunch.EXE Binary Proxy Execution Abuse","author":"Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2023-08-08","modified":null,"description":"Detects child processes of \"provlaunch.exe\" which might indicate potential abuse to proxy execution.","references":["https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/","https://twitter.com/0gtweet/status/1674399582162153472"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_provlaunch_potential_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"811f459f-9231-45d4-959a-0266c6311987","title":"Suspicious Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-16","modified":null,"description":"Detects suspicious child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_suspicious_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"81ebd28b-9607-4478-bf06-974ed9d53ed7","title":"Potential Application Whitelisting Bypass via Dnx.EXE","author":"Beyu Denis, oscd.community","status":"test","level":"medium","date":"2019-10-26","modified":"2024-04-24","description":"Detects the execution of Dnx.EXE. The Dnx utility allows for the execution of C# code.\nAttackers might abuse this in order to bypass application whitelisting.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Csi/","https://enigma0x3.net/2016/11/17/bypassing-application-whitelisting-by-using-dnx-exe/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1027.004"],"path":"rules/windows/process_creation/proc_creation_win_dnx_execute_csharp_code.yml","techniques":["T1218","T1027.004"],"cves":[]},{"id":"835e75bf-4bfd-47a4-b8a6-b766cac8bcb7","title":"Uncommon Child Process Of Setres.EXE","author":"@gott_cyber, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-12-11","modified":"2024-06-26","description":"Detects uncommon child process of Setres.EXE.\nSetres.EXE is a Windows server only process and tool that can be used to set the screen resolution.\nIt can potentially be abused in order to launch any arbitrary file with a name containing the word \"choice\" from the current execution path.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Setres/","https://twitter.com/0gtweet/status/1583356502340870144","https://strontic.github.io/xcyclopedia/library/setres.exe-0E30E4C09637D7A128A37B59A3BC4D09.html","https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731033(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_setres_uncommon_child_process.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"84232095-ecca-4015-b0d7-7726507ee793","title":"Suspicious DLL Loaded via CertOC.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-02-15","modified":"2024-03-05","description":"Detects when a user installs certificates by using CertOC.exe to load the target DLL file.","references":["https://twitter.com/sblmsrsn/status/1445758411803480072?s=20","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-fe98e74189873d6df72a15df2eaa0315c59ba9cdaca93ecd68afc4ea09194ef2","https://lolbas-project.github.io/lolbas/Binaries/Certoc/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_certoc_load_dll_susp_locations.yml","techniques":["T1218"],"cves":[]},{"id":"863218bd-c7d0-4c52-80cd-0a96c09f54af","title":"Arbitrary File Download Via IMEWDBLD.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"high","date":"2023-11-09","modified":null,"description":"Detects usage of \"IMEWDBLD.exe\" to download arbitrary files","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1105/T1105.md#atomic-test-10---windows---powershell-download","https://lolbas-project.github.io/lolbas/Binaries/IMEWDBLD/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_imewbdld_download.yml","techniques":["T1218"],"cves":[]},{"id":"8e0bb260-d4b2-4fff-bb8d-3f82118e6892","title":"Potentially Suspicious CMD Shell Output Redirect","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-12","modified":"2024-03-19","description":"Detects inline Windows shell commands redirecting output via the \">\" symbol to a suspicious location.\nThis technique is sometimes used by malicious actors in order to redirect the output of reconnaissance commands such as \"hostname\" and \"dir\" to files for future exfiltration.\n","references":["https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_cmd_redirection_susp_folder.yml","techniques":["T1218"],"cves":[]},{"id":"90d50722-0483-4065-8e35-57efaadd354d","title":"Arbitrary MSI Download Via Devinit.EXE","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2022-01-11","modified":"2023-04-06","description":"Detects a certain command line flag combination used by \"devinit.exe\", which can be abused as a LOLBIN to download arbitrary MSI packages on a Windows system","references":["https://twitter.com/mrd0x/status/1460815932402679809","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devinit/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_devinit_lolbin_usage.yml","techniques":["T1218"],"cves":[]},{"id":"90dcf730-1b71-4ae7-9ffc-6fcf62bd0132","title":"Suspicious ZipExec Execution","author":"frack113","status":"test","level":"medium","date":"2021-11-07","modified":"2022-12-25","description":"ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file.","references":["https://twitter.com/SBousseaden/status/1451237393017839616","https://github.com/Tylous/ZipExec"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_hktl_zipexec.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"9257c05b-4a4a-48e5-a670-b7b073cf401b","title":"Binary Proxy Execution Via Dotnet-Trace.EXE","author":"Jimmy Bayne (@bohops)","status":"test","level":"medium","date":"2024-01-02","modified":null,"description":"Detects commandline arguments for executing a child process via dotnet-trace.exe","references":["https://twitter.com/bohops/status/1740022869198037480"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dotnet_trace_lolbin_execution.yml","techniques":["T1218"],"cves":[]},{"id":"93bbde78-dc86-4e73-9ffc-ff8a384ca89c","title":"Potential Compromised 3CXDesktopApp Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-03-29","modified":"2024-11-23","description":"Detects execution of known compromised version of 3CXDesktopApp","references":["https://www.reddit.com/r/crowdstrike/comments/125r3uu/20230329_situational_awareness_crowdstrike/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_execution.yml","techniques":["T1218"],"cves":[]},{"id":"9577edbb-851f-4243-8c91-1d5b50c1a39b","title":"Atbroker Registry Change","author":"Mateusz Wydra, oscd.community","status":"test","level":"medium","date":"2020-10-13","modified":"2023-01-19","description":"Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'","references":["http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/","https://lolbas-project.github.io/lolbas/Binaries/Atbroker/"],"logsource":{"product":"windows","category":"registry_event"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1218","attack.persistence","attack.t1547"],"path":"rules/windows/registry/registry_event/registry_event_susp_atbroker_change.yml","techniques":["T1218","T1547"],"cves":[]},{"id":"961e0abb-1b1e-4c84-a453-aafe56ad0d34","title":"Execution via stordiag.exe","author":"Austin Songer (@austinsonger)","status":"test","level":"high","date":"2021-10-21","modified":"2022-12-25","description":"Detects the use of stordiag.exe to execute schtasks.exe systeminfo.exe and fltmc.exe","references":["https://strontic.github.io/xcyclopedia/library/stordiag.exe-1F08FC87C373673944F6A7E8B18CD845.html","https://twitter.com/eral4m/status/1451112385041911809"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_stordiag_susp_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"9a2d8b3e-f5a1-4c68-9e21-7d9e1cf8a123","title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053 - Process Access","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-13","modified":null,"description":"Detects potential exploitation of remote code execution vulnerability CVE-2025-33053\nby looking for process access that involves legitimate Windows executables (iediagcmd.exe, CustomShellHost.exe)\naccessing suspicious executables hosted on WebDAV shares. This indicates an attacker may be exploiting\nProcess.Start() search order manipulation to execute malicious code from attacker-controlled WebDAV servers\ninstead of legitimate system binaries. The vulnerability allows unauthorized code execution through\nexternal control of file names or paths via WebDAV.\n","references":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053","https://research.checkpoint.com/2025/stealth-falcon-zero-day/"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1218","attack.lateral-movement","attack.t1105","detection.emerging-threats","cve.2025-33053"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_access_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"],"cves":["CVE-2025-33053"]},{"id":"9c7e131a-0f2c-4ae0-9d43-b04f4e266d43","title":"Uncommon Child Process Of Appvlp.EXE","author":"Sreeman","status":"test","level":"medium","date":"2020-03-13","modified":"2023-11-09","description":"Detects uncommon child processes of Appvlp.EXE\nAppvlp or the Application Virtualization Utility is included with Microsoft Office. Attackers are able to abuse \"AppVLP\" to execute shell commands.\nNormally, this binary is used for Application Virtualization, but it can also be abused to circumvent the ASR file path rule folder\nor to mark a file as a system file.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Appvlp/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_appvlp_uncommon_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"9c8c7000-3065-44a8-a555-79bcba5d9955","title":"MSDT Execution Via Answer File","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-13","modified":"2025-10-29","description":"Detects execution of \"msdt.exe\" using an answer file which is simulating the legitimate way of calling msdt via \"pcwrun.exe\" (For example from the compatibility tab).\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Msdt/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_msdt_answer_file_exec.yml","techniques":["T1218"],"cves":[]},{"id":"9cfc00b6-bfb7-49ce-9781-ef78503154bb","title":"Wlrmdr.EXE Uncommon Argument Or Child Process","author":"frack113, manasmbellani","status":"experimental","level":"medium","date":"2022-02-16","modified":"2025-10-31","description":"Detects the execution of \"Wlrmdr.exe\" with the \"-u\" command line flag which allows anything passed to it to be an argument of the ShellExecute API, which would allow an attacker to execute arbitrary binaries.\nThis detection also focuses on any uncommon child processes spawned from \"Wlrmdr.exe\" as a supplement for those that posses \"ParentImage\" telemetry.\n","references":["https://twitter.com/0gtweet/status/1493963591745220608?s=20&t=xUg9DsZhJy1q9bPTUWgeIQ","https://lolbas-project.github.io/lolbas/Binaries/Wlrmdr/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_wlrmdr_uncommon_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"9eb271b9-24ae-4cd4-9465-19cfc1047f3e","title":"Potential Proxy Execution Via Explorer.EXE From Shell Process","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative","status":"test","level":"low","date":"2020-10-05","modified":"2024-06-21","description":"Detects the creation of a child \"explorer.exe\" process from a shell like process such as \"cmd.exe\" or \"powershell.exe\".\nAttackers can use \"explorer.exe\" for evading defense mechanisms by proxying the execution through the latter.\nWhile this is often a legitimate action, this rule can be use to hunt for anomalies.\nMuddy Waters threat actor was seeing using this technique.\n","references":["https://twitter.com/CyberRaiju/status/1273597319322058752","https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_explorer_child_of_shell_process.yml","techniques":["T1218"],"cves":[]},{"id":"9f107a84-532c-41af-b005-8d12a607639f","title":"Potentially Suspicious Cabinet File Expansion","author":"Bhabesh Raj, X__Junior (Nextron Systems)","status":"test","level":"medium","date":"2021-07-30","modified":"2024-11-13","description":"Detects the expansion or decompression of cabinet files from potentially suspicious or uncommon locations, e.g. seen in Iranian MeteorExpress related attacks","references":["https://labs.sentinelone.com/meteorexpress-mysterious-wiper-paralyzes-iranian-trains-with-epic-troll","https://blog.malwarebytes.com/threat-intelligence/2021/08/new-variant-of-konni-malware-used-in-campaign-targetting-russia/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_expand_cabinet_files.yml","techniques":["T1218"],"cves":[]},{"id":"9f2cc74d-78af-4eb2-bb64-9cd1d292b87b","title":"Microsoft Sync Center Suspicious Network Connections","author":"elhoim","status":"test","level":"medium","date":"2022-04-28","modified":"2024-03-12","description":"Detects suspicious connections from Microsoft Sync Center to non-private IPs.","references":["https://redcanary.com/blog/intelligence-insights-november-2021/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.t1218","attack.execution"],"path":"rules/windows/network_connection/net_connection_win_susp_outbound_mobsync_connection.yml","techniques":["T1055","T1218"],"cves":[]},{"id":"9f38c1db-e2ae-40bf-81d0-5b68f73fb512","title":"Suspicious BitLocker Access Agent Update Utility Execution","author":"andrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-18","modified":null,"description":"Detects the execution of the BitLocker Access Agent Update Utility (baaupdate.exe) which is not a common parent process for other processes.\nSuspicious child processes spawned by baaupdate.exe could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking.\n","references":["https://github.com/rtecCyberSec/BitlockMove"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.lateral-movement","attack.t1021.003"],"path":"rules/windows/process_creation/proc_creation_win_baaupdate_susp_child_process.yml","techniques":["T1218","T1021.003"],"cves":[]},{"id":"9f546b25-5f12-4c8d-8532-5893dcb1e4b8","title":"Potentially Suspicious Child Process Of DiskShadow.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-15","modified":null,"description":"Detects potentially suspicious child processes of \"Diskshadow.exe\". This could be an attempt to bypass parent/child relationship detection or application whitelisting rules.","references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow","https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf","https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware","https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_diskshadow_child_process_susp.yml","techniques":["T1218"],"cves":[]},{"id":"a20391f8-76fb-437b-abc0-dba2df1952c6","title":"Visual Studio NodejsTools PressAnyKey Arbitrary Binary Execution","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-01-11","modified":"2023-04-11","description":"Detects child processes of Microsoft.NodejsTools.PressAnyKey.exe that can be used to execute any other binary","references":["https://twitter.com/mrd0x/status/1463526834918854661","https://gist.github.com/nasbench/a989ce64cefa8081bd50cf6ad8c491b5"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_pressanykey_lolbin_execution.yml","techniques":["T1218"],"cves":[]},{"id":"a6fc3c46-23b8-4996-9ea2-573f4c4d88c5","title":"RemoteFXvGPUDisablement Abuse Via AtomicTestHarnesses","author":"frack113","status":"test","level":"high","date":"2021-07-13","modified":"2023-05-09","description":"Detects calls to the AtomicTestHarnesses \"Invoke-ATHRemoteFXvGPUDisablementCommand\" which is designed to abuse the \"RemoteFXvGPUDisablement.exe\" binary to run custom PowerShell code via module load-order hijacking.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"a85ffc3a-e8fd-4040-93bf-78aff284d801","title":"Use Of The SFTP.EXE Binary As A LOLBIN","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-11-10","modified":null,"description":"Detects the usage of the \"sftp.exe\" binary as a LOLBIN by abusing the \"-D\" flag","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/264"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_sftp.yml","techniques":["T1218"],"cves":[]},{"id":"aaf46cdc-934e-4284-b329-34aa701e3771","title":"Uncommon Child Process Of BgInfo.EXE","author":"Nasreddine Bencherchali (Nextron Systems), Beyu Denis, oscd.community","status":"test","level":"medium","date":"2019-10-26","modified":"2023-08-16","description":"Detects uncommon child processes of \"BgInfo.exe\" which could be a sign of potential abuse of the binary to proxy execution via external VBScript","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Bginfo/","https://oddvar.moe/2017/05/18/bypassing-application-whitelisting-with-bginfo/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_bginfo_uncommon_child_process.yml","techniques":["T1059.005","T1218","T1202"],"cves":[]},{"id":"ab90dab8-c7da-4010-9193-563528cfa347","title":"Potentially Suspicious Self Extraction Directive File Created","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-02-05","modified":null,"description":"Detects the creation of a binary file with the \".sed\" extension. The \".sed\" extension stand for Self Extraction Directive files.\nThese files are used by the \"iexpress.exe\" utility in order to create self extracting packages.\nAttackers were seen abusing this utility and creating PE files with embedded \".sed\" entries.\nUsually \".sed\" files are simple ini files and not PE binaries.\n","references":["https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html","https://en.wikipedia.org/wiki/IExpress","https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior"],"logsource":{"product":"windows","category":"file_executable_detected"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_executable_detected/file_executable_detected_win_susp_embeded_sed_file.yml","techniques":["T1218"],"cves":[]},{"id":"abe06362-a5b9-4371-8724-ebd00cd48a04","title":"Potential Exploitation of RCE Vulnerability CVE-2025-33053","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-06-13","modified":null,"description":"Detects potential exploitation of remote code execution vulnerability CVE-2025-33053\nwhich involves unauthorized code execution via WebDAV through external control of file names or paths.\nThe exploit abuses legitimate utilities like iediagcmd.exe or CustomShellHost.exe  by manipulating\ntheir working directories to point to attacker-controlled WebDAV servers, causing them to execute\nmalicious executables (like route.exe) from the WebDAV path instead of legitimate system binaries\nthrough Process.Start() search order manipulation.\n","references":["https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053","https://research.checkpoint.com/2025/stealth-falcon-zero-day/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1218","attack.lateral-movement","attack.t1105","detection.emerging-threats","cve.2025-33053"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-33053/proc_creation_win_exploit_cve_2025_33053.yml","techniques":["T1218","T1105"],"cves":["CVE-2025-33053"]},{"id":"ac1c92b4-ac81-405a-9978-4604d78cc47e","title":"Potential Binary Proxy Execution Via VSDiagnostics.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-08-03","modified":null,"description":"Detects execution of \"VSDiagnostics.exe\" with the \"start\" command in order to launch and proxy arbitrary binaries.","references":["https://twitter.com/0xBoku/status/1679200664013135872"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_vsdiagnostics_execution_proxy.yml","techniques":["T1218"],"cves":[]},{"id":"af5732ed-764e-489d-826d-0447c8b36242","title":"Windows MSIX Package Support Framework AI_STUBS Execution","author":"Michael Haag, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"low","date":"2025-11-03","modified":null,"description":"Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.\nThis activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.\n","references":["https://redcanary.com/blog/threat-intelligence/msix-installers/","https://redcanary.com/threat-detection-report/techniques/installer-packages/","https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework","https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.defense-impairment","attack.t1218","attack.t1553.005","attack.t1204.002"],"path":"rules/windows/process_creation/proc_creation_win_msix_ai_stub_execution.yml","techniques":["T1218","T1553.005","T1204.002"],"cves":[]},{"id":"af77cf95-c469-471c-b6a0-946c685c4798","title":"Proxy Execution Via Wuauclt.EXE","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), Florian Roth (Nextron Systems), Sreeman, FPT.EagleEye Team","status":"test","level":"high","date":"2020-10-12","modified":"2023-11-11","description":"Detects the use of the Windows Update Client binary (wuauclt.exe) for proxy execution.","references":["https://dtm.uk/wuauclt/","https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_wuauclt_dll_loading.yml","techniques":["T1218"],"cves":[]},{"id":"b124ddf4-778d-418e-907f-6dd3fc0d31cd","title":"Arbitrary File Download Via PresentationHost.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":"2023-11-09","description":"Detects usage of \"PresentationHost\" which is a utility that runs \".xbap\" (Browser Applications) files to download arbitrary files","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/239/files"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_presentationhost_download.yml","techniques":["T1218"],"cves":[]},{"id":"b2309017-4235-44fe-b5af-b15363011957","title":"Uncommon Child Process Of Defaultpack.EXE","author":"frack113","status":"test","level":"medium","date":"2022-12-31","modified":"2024-04-22","description":"Detects uncommon child processes of \"DefaultPack.EXE\" binary as a proxy to launch other programs","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/DefaultPack/","https://www.echotrail.io/insights/search/defaultpack.exe"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_defaultpack_uncommon_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"b2b048b0-7857-4380-b0fb-d3f0ab820b71","title":"Self Extracting Package Creation Via Iexpress.EXE From Potentially Suspicious Location","author":"Joseliyo Sanchez, @Joseliyo_Jstnk, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-02-05","modified":"2024-06-04","description":"Detects the use of iexpress.exe to create binaries via Self Extraction Directive (SED) files located in potentially suspicious locations.\nThis behavior has been observed in-the-wild by different threat actors.\n","references":["https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html","https://en.wikipedia.org/wiki/IExpress","https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/","https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_iexpress_susp_execution.yml","techniques":["T1218"],"cves":[]},{"id":"b30a8bc5-e21b-4ca2-9420-0a94019ac56a","title":"Use of VisualUiaVerifyNative.exe","author":"Christopher Peacock @SecurePeacock, SCYTHE @scythe_io","status":"test","level":"medium","date":"2022-06-01","modified":null,"description":"VisualUiaVerifyNative.exe is a Windows SDK that can be used for AWL bypass and is listed in Microsoft's recommended block rules.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/VisualUiaVerifyNative/","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac","https://bohops.com/2020/10/15/exploring-the-wdac-microsoft-recommended-block-rules-visualuiaverifynative/","https://github.com/MicrosoftDocs/windows-itpro-docs/commit/937db704b9148e9cee7c7010cad4d00ce9c4fdad"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_visualuiaverifynative.yml","techniques":["T1218"],"cves":[]},{"id":"b5746143-59d6-4603-8d06-acbd60e166ee","title":"Uncommon Child Process Of AddinUtil.EXE","author":"Michael McKinley (@McKinleyMike), Tony Latteri (@TheLatteri)","status":"test","level":"medium","date":"2023-09-18","modified":null,"description":"Detects uncommon child processes of the Add-In deployment cache updating utility (AddInutil.exe) which could be a sign of potential abuse of the binary to proxy execution via a custom Addins.Store payload.\n","references":["https://www.blue-prints.blog/content/blog/posts/lolbin/addinutil-lolbas.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_addinutil_uncommon_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"b5c7395f-e501-4a08-94d4-57fe7a9da9d2","title":"Potential Binary Proxy Execution Via Cdb.EXE","author":"Beyu Denis, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2019-10-26","modified":"2024-04-22","description":"Detects usage of \"cdb.exe\" to launch arbitrary processes or commands from a debugger script file","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Cdb/","https://web.archive.org/web/20170715043507/http://www.exploit-monday.com/2016/08/windbg-cdb-shellcode-runner.html","https://twitter.com/nas_bench/status/1534957360032120833"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1106","attack.t1218","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_cdb_arbitrary_command_execution.yml","techniques":["T1106","T1218","T1127"],"cves":[]},{"id":"b8b1b304-a60f-4999-9a6e-c547bde03ffd","title":"DeviceCredentialDeployment Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-08-19","modified":null,"description":"Detects the execution of DeviceCredentialDeployment to hide a process from view.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/pull/147"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_device_credential_deployment.yml","techniques":["T1218"],"cves":[]},{"id":"b97cd4b1-30b8-4a9d-bd72-6293928d52bc","title":"Indirect Command Execution By Program Compatibility Wizard","author":"A. Sungurov , oscd.community","status":"test","level":"low","date":"2020-10-12","modified":"2021-11-27","description":"Detect indirect command execution via Program Compatibility Assistant pcwrun.exe","references":["https://twitter.com/pabraeken/status/991335019833708544","https://lolbas-project.github.io/lolbas/Binaries/Pcwrun/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pcwrun.yml","techniques":["T1218"],"cves":[]},{"id":"bac9fb54-2da7-44e9-988f-11e9a5edbc0c","title":"Potential Password Spraying Attempt Using Dsacls.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-06-20","modified":"2023-02-04","description":"Detects possible password spraying attempts using Dsacls","references":["https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/using-dsacls-to-check-ad-object-permissions#password-spraying-anyone","https://ss64.com/nt/dsacls.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771151(v=ws.11)"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dsacls_password_spray.yml","techniques":["T1218"],"cves":[]},{"id":"bafac3d6-7de9-4dd9-8874-4a1194b493ed","title":"Abusing Print Executable","author":"Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative","status":"test","level":"medium","date":"2020-10-05","modified":"2022-07-07","description":"Attackers can use print.exe for remote file copy","references":["https://lolbas-project.github.io/lolbas/Binaries/Print/","https://twitter.com/Oddvarmoe/status/985518877076541440"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_print_remote_file_copy.yml","techniques":["T1218"],"cves":[]},{"id":"bcfece3d-56fe-4545-9931-3b8e92927db1","title":"Winrs Local Command Execution","author":"Liran Ravich, Nasreddine Bencherchali","status":"experimental","level":"high","date":"2025-10-22","modified":null,"description":"Detects the execution of Winrs.exe where it is used to execute commands locally.\nCommands executed this way are launched under Winrshost.exe and can represent proxy execution used for defense evasion or lateral movement.\n","references":["https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.lateral-movement","attack.stealth","attack.t1021.006","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_winrs_local_command_execution.yml","techniques":["T1021.006","T1218"],"cves":[]},{"id":"c0b40568-b1e9-4b03-8d6c-b096da6da9ab","title":"Suspicious AgentExecutor PowerShell Execution","author":"Nasreddine Bencherchali (Nextron Systems), memory-shards","status":"test","level":"high","date":"2022-12-24","modified":"2024-08-07","description":"Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy \"Bypass\" or any binary named \"powershell.exe\" located in the path provided by 6th positional argument","references":["https://twitter.com/lefterispan/status/1286259016436514816","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Agentexecutor/","https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension","https://twitter.com/jseerden/status/1247985304667066373/photo/1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_agentexecutor_susp_usage.yml","techniques":["T1218"],"cves":[]},{"id":"c2b478fc-09bf-40b2-8768-ab3ec8d61c9a","title":"New Self Extracting Package Created Via IExpress.EXE","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2024-02-05","modified":null,"description":"Detects the \"iexpress.exe\" utility creating self-extracting packages.\nAttackers where seen leveraging \"iexpress\" to compile packages on the fly via \".sed\" files.\nInvestigate the command line options provided to \"iexpress\" and in case of a \".sed\" file, check the contents and legitimacy of it.\n","references":["https://strontic.github.io/xcyclopedia/library/iexpress.exe-D594B2A33EFAFD0EABF09E3FDC05FCEA.html","https://en.wikipedia.org/wiki/IExpress","https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/","https://www.virustotal.com/gui/file/602f4ae507fa8de57ada079adff25a6c2a899bd25cd092d0af7e62cdb619c93c/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_iexpress_execution.yml","techniques":["T1218"],"cves":[]},{"id":"c649a6c7-cd8c-4a78-9c04-000fc76df954","title":"Potentially Suspicious Wuauclt Network Connection","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-10-12","modified":"2024-03-12","description":"Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.\nOne could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.\n","references":["https://dtm.uk/wuauclt/"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/network_connection/net_connection_win_wuauclt_network_connection.yml","techniques":["T1218"],"cves":[]},{"id":"cacef8fc-9d3d-41f7-956d-455c6e881bc5","title":"Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell ScriptBlock","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-09","modified":null,"description":"Detects PowerShell module creation where the module Contents are set to \"function Get-VMRemoteFXPhysicalVideoAdapter\". This could be a sign of potential abuse of the \"RemoteFXvGPUDisablement.exe\" binary which is known to be vulnerable to module load-order hijacking.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/powershell/powershell_script/posh_ps_remotefxvgpudisablement_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"cc268ac1-42d9-40fd-9ed3-8c4e1a5b87e6","title":"Devtoolslauncher.exe Executes Specified Binary","author":"Beyu Denis, oscd.community (rule), @_felamos (idea)","status":"test","level":"high","date":"2019-10-12","modified":"2021-11-27","description":"The Devtoolslauncher.exe executes other binary","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Devtoolslauncher/","https://twitter.com/_felamos/status/1179811992841797632"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_devtoolslauncher.yml","techniques":["T1218"],"cves":[]},{"id":"cd3d1298-eb3b-476c-ac67-12847de55813","title":"DLL Execution via Rasautou.exe","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":null,"description":"Detects using Rasautou.exe for loading arbitrary .DLL specified in -d option and executes the export specified in -p.","references":["https://lolbas-project.github.io/lolbas/Binaries/Rasautou/","https://github.com/fireeye/DueDLLigence","https://www.fireeye.com/blog/threat-research/2019/10/staying-hidden-on-the-endpoint-evading-detection-with-shellcode.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_rasautou_dll_execution.yml","techniques":["T1218"],"cves":[]},{"id":"cd71385d-fd9b-4691-9b98-2b1f7e508714","title":"Lolbin Runexehelper Use As Proxy","author":"frack113","status":"test","level":"medium","date":"2022-12-29","modified":null,"description":"Detect usage of the \"runexehelper.exe\" binary as a proxy to launch other programs","references":["https://twitter.com/0gtweet/status/1206692239839289344","https://lolbas-project.github.io/lolbas/Binaries/Runexehelper/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_runexehelper.yml","techniques":["T1218"],"cves":[]},{"id":"ce2c44b5-a6ac-412a-afba-9e89326fa972","title":"Regsvr32.EXE Calling of DllRegisterServer Export Function Implicitly","author":"Andreas Braathen (mnemonic.io), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-10-17","modified":null,"description":"Detects execution of regsvr32 with the silent flag and no other flags on a DLL located in an uncommon or potentially suspicious location.\nWhen Regsvr32 is called in such a way, it implicitly calls the DLL export function 'DllRegisterServer'.\n","references":["https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/","https://www.virustotal.com/gui/file/288fc4f954f98d724e6fab32a89477943df5c0e9662cb199a19b90ae0c63aebe/detection","https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver","https://ss64.com/nt/regsvr32.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_regsvr32_dllregisterserver_exec.yml","techniques":["T1218"],"cves":[]},{"id":"ce7cf472-6fcc-490a-9481-3786840b5d9b","title":"InfDefaultInstall.exe .inf Execution","author":"frack113","status":"test","level":"medium","date":"2021-07-13","modified":"2022-10-09","description":"Executes SCT script using scrobj.dll from a command in entered into a specially prepared INF file.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md#atomic-test-4---infdefaultinstallexe-inf-execution","https://lolbas-project.github.io/lolbas/Binaries/Infdefaultinstall/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts.yml","techniques":["T1218"],"cves":[]},{"id":"cec8e918-30f7-4e2d-9bfa-a59cc97ae60f","title":"OpenWith.exe Executes Specified Binary","author":"Beyu Denis, oscd.community (rule), @harr0ey (idea)","status":"test","level":"high","date":"2019-10-12","modified":"2021-11-27","description":"The OpenWith.exe executes other binary","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/4db780e0f0b2e2bb8cb1fa13e09196da9b9f1834/yml/LOLUtilz/OSBinaries/Openwith.yml","https://twitter.com/harr0ey/status/991670870384021504"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_openwith.yml","techniques":["T1218"],"cves":[]},{"id":"cfed2f44-16df-4bf3-833a-79405198b277","title":"Dllhost.EXE Initiated Network Connection To Non-Local IP Address","author":"bartblaze","status":"test","level":"medium","date":"2020-07-13","modified":"2024-07-16","description":"Detects Dllhost.EXE initiating a network connection to a non-local IP address.\nAside from Microsoft own IP range that needs to be excluded. Network communication from Dllhost will depend entirely on the hosted DLL.\nAn initial baseline is recommended before deployment.\n","references":["https://redcanary.com/blog/child-processes/","https://nasbench.medium.com/what-is-the-dllhost-exe-process-actually-running-ef9fe4c19c08"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.stealth","attack.t1218","attack.execution","attack.t1559.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/network_connection/net_connection_win_dllhost_non_local_ip.yml","techniques":["T1218","T1559.001"],"cves":[]},{"id":"d06be4b9-8045-428b-a567-740a26d9db25","title":"Verclsid.exe Runs COM Object","author":"Victor Sergeev, oscd.community","status":"test","level":"medium","date":"2020-10-09","modified":"2025-10-07","description":"Detects when verclsid.exe is used to run COM object via GUID","references":["https://lolbas-project.github.io/lolbas/Binaries/Verclsid/","https://gist.github.com/NickTyrer/0598b60112eaafe6d07789f7964290d5","https://bohops.com/2018/08/18/abusing-the-com-registry-structure-part-2-loading-techniques-for-evasion-and-persistence/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_verclsid_runs_com.yml","techniques":["T1218"],"cves":[]},{"id":"d22e2925-cfd8-463f-96f6-89cec9d9bc5f","title":"XBAP Execution From Uncommon Locations Via PresentationHost.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-01","modified":"2023-11-09","description":"Detects the execution of \".xbap\" (Browser Applications) files via PresentationHost.EXE from an uncommon location. These files can be abused to run malicious \".xbap\" files any bypass AWL\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Presentationhost/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_presentationhost_uncommon_location_exec.yml","techniques":["T1218"],"cves":[]},{"id":"d3bf399f-b0cf-4250-8bb4-dfc192ab81dc","title":"Ie4uinit Lolbin Use From Invalid Path","author":"frack113","status":"test","level":"medium","date":"2022-05-07","modified":"2022-05-16","description":"Detect use of ie4uinit.exe to execute commands from a specially prepared ie4uinit.inf file from a directory other than the usual directories","references":["https://lolbas-project.github.io/lolbas/Binaries/Ie4uinit/","https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit.yml","techniques":["T1218"],"cves":[]},{"id":"d80d5c81-04ba-45b4-84e4-92eba40e0ad3","title":"Arbitrary DLL or Csproj Code Execution Via Dotnet.EXE","author":"Beyu Denis, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2025-10-08","description":"Detects execution of arbitrary DLLs or unsigned code via a \".csproj\" files via Dotnet.EXE.","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Dotnet/","https://twitter.com/_felamos/status/1204705548668555264","https://bohops.com/2019/08/19/dotnet-core-a-vector-for-awl-bypass-defense-evasion/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_dotnet_arbitrary_dll_csproj_execution.yml","techniques":["T1218"],"cves":[]},{"id":"d81a9fc6-55db-4461-b962-0e78fea5b0ad","title":"Rundll32.EXE Calling DllRegisterServer Export Function Explicitly","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-10-17","modified":null,"description":"Detects when the DLL export function 'DllRegisterServer' is called in the commandline by Rundll32 explicitly where the DLL is located in a non-standard path.\n","references":["https://thedfirreport.com/2023/08/28/html-smuggling-leads-to-domain-wide-ransomware/","https://www.virustotal.com/gui/file/94816439312563db982cd038cf77cbc5ef4c7003e3edee86e2b0f99e675ed4ed/behavior","https://learn.microsoft.com/en-us/windows/win32/api/olectl/nf-olectl-dllregisterserver"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_rundll32_dllregisterserver.yml","techniques":["T1218"],"cves":[]},{"id":"dddfebae-c46f-439c-af7a-fdb6bde90218","title":"SyncAppvPublishingServer Execution to Bypass Powershell Restriction","author":"Ensar Şamil, @sblmsrsn, OSCD Community","status":"test","level":"medium","date":"2020-10-05","modified":"2022-12-25","description":"Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.","references":["https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/powershell/powershell_script/posh_ps_syncappvpublishingserver_exe.yml","techniques":["T1218"],"cves":[]},{"id":"dec44ca7-61ad-493c-bfd7-8819c5faa09b","title":"Arbitrary Command Execution Using WSL","author":"oscd.community, Zach Stanford @svch0st, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2020-10-05","modified":"2023-04-12","description":"Detects potential abuse of Windows Subsystem for Linux (WSL) binary as a Living of the Land binary in order to execute arbitrary Linux or Windows commands.\n","references":["https://lolbas-project.github.io/lolbas/OtherMSBinaries/Wsl/","https://twitter.com/nas_bench/status/1535431474429808642"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_wsl_arbitrary_command_execution.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"dfa03a09-8b92-4d83-8e74-f72839b1c407","title":"Potentially Suspicious Child Processes Spawned by ConHost","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-02-05","modified":null,"description":"Detects suspicious child processes related to Windows Shell utilities spawned by `conhost.exe`, which could indicate malicious activity using trusted system components.","references":["https://tria.ge/241015-l98snsyeje/behavioral2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1202","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_conhost_susp_winshell_child_process.yml","techniques":["T1202","T1218"],"cves":[]},{"id":"e0b06658-7d1d-4cd3-bf15-03467507ff7c","title":"Suspicious DotNET CLR Usage Log Artifact","author":"frack113, omkar72, oscd.community, Wojciech Lesicki","status":"test","level":"high","date":"2022-11-18","modified":"2023-02-23","description":"Detects the creation of Usage Log files by the CLR (clr.dll). These files are named after the executing process once the assembly is finished executing for the first time in the (user) session context.","references":["https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/","https://github.com/olafhartong/sysmon-modular/blob/fa1ae53132403d262be2bbd7f17ceea7e15e8c78/11_file_create/include_dotnet.xml","https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008","https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_event/file_event_win_net_cli_artefact.yml","techniques":["T1218"],"cves":[]},{"id":"e5144106-8198-4f6e-bfc2-0a551cc8dd94","title":"Potential Pikabot Infection - Suspicious Command Combinations Via Cmd.EXE","author":"Alejandro Houspanossian ('@lekz86')","status":"test","level":"medium","date":"2024-01-02","modified":null,"description":"Detects the execution of concatenated commands via \"cmd.exe\". Pikabot often executes a combination of multiple commands via the command handler \"cmd /c\" in order to download and execute additional payloads.\nCommands such as \"curl\", \"wget\" in order to download extra payloads. \"ping\" and \"timeout\" are abused to introduce delays in the command execution and \"Rundll32\" is also used to execute malicious DLL files.\nIn the observed Pikabot infections, a combination of the commands described above are used to orchestrate the download and execution of malicious DLL files.\n","references":["https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_30.10.2023.txt","https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_22.12.2023.txt"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.execution","attack.stealth","attack.t1059.003","attack.t1105","attack.t1218","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Pikabot/proc_creation_win_malware_pikabot_combined_commands_execution.yml","techniques":["T1059.003","T1105","T1218"],"cves":[]},{"id":"e7581747-1e44-4d4b-85a6-0db0b4a00f2a","title":"Potential Compromised 3CXDesktopApp Update Activity","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-03-29","modified":null,"description":"Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software","references":["https://www.linkedin.com/feed/update/urn:li:activity:7047435754834198529/","https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","attack.execution","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/3CX-Supply-Chain/proc_creation_win_malware_3cx_compromise_susp_update.yml","techniques":["T1218"],"cves":[]},{"id":"e76c8240-d68f-4773-8880-5c6f63595aaf","title":"Time Travel Debugging Utility Usage - Image","author":"Ensar Şamil, @sblmsrsn, @oscd_initiative","status":"test","level":"high","date":"2020-10-06","modified":"2022-12-02","description":"Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.","references":["https://lolbas-project.github.io/lolbas/Binaries/Tttracer/","https://twitter.com/mattifestation/status/1196390321783025666","https://twitter.com/oulusoyum/status/1191329746069655553"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.credential-access","attack.stealth","attack.t1218","attack.t1003.001"],"path":"rules/windows/image_load/image_load_dll_tttracer_module_load.yml","techniques":["T1218","T1003.001"],"cves":[]},{"id":"e84d89c4-f544-41ca-a6af-4b92fd38b023","title":"Arbitrary File Download Via MSEDGE_PROXY.EXE","author":"Swachchhanda Shrawan Poudel","status":"test","level":"medium","date":"2023-11-09","modified":null,"description":"Detects usage of \"msedge_proxy.exe\" to download arbitrary files","references":["https://lolbas-project.github.io/lolbas/Binaries/msedge_proxy/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_msedge_proxy_download.yml","techniques":["T1218"],"cves":[]},{"id":"e8954be4-b2b8-4961-be18-da1a5bda709c","title":"Potential Devil Bait Malware Reconnaissance","author":"Nasreddine Bencherchali (Nextron Systems), NCSC (Idea)","status":"test","level":"high","date":"2023-05-15","modified":"2025-10-19","description":"Detects specific process behavior observed with Devil Bait samples","references":["https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/devil-bait/NCSC-MAR-Devil-Bait.pdf","https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca428591b4a9872ce1f1e9b/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/Devil-Bait/proc_creation_win_malware_devil_bait_output_redirect.yml","techniques":["T1218"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"f0540f7e-2db3-4432-b9e0-3965486744bc","title":"Legitimate Application Dropped Executable","author":"frack113, Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-21","modified":"2026-05-11","description":"Detects LOLBINs and applications that should not legitimately drop executable or executable-equivalent files to disk.\nThis may indicate malware staging, process injection, or abuse of a trusted binary for payload delivery.\n","references":["https://github.com/Neo23x0/sysmon-config/blob/3f808d9c022c507aae21a9346afba4a59dd533b9/sysmonconfig-export-block.xml#L1326","https://dmpdump.github.io/posts/TelegramRat/","https://www.virustotal.com/gui/file/a0d5b30578acd1df9139e7a8a4bfc659dc2cf48f4dc0c5804b70890adeb9fa21/behavior"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/file/file_event/file_event_win_susp_legitimate_app_dropping_exe.yml","techniques":["T1218"],"cves":[]},{"id":"f24bcaea-0cd1-11eb-adc1-0242ac120002","title":"Uncommon  Assistive Technology Applications Execution Via AtBroker.EXE","author":"Mateusz Wydra, oscd.community","status":"test","level":"medium","date":"2020-10-12","modified":"2024-03-06","description":"Detects the start of a non built-in assistive technology applications via \"Atbroker.EXE\".","references":["http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/","https://lolbas-project.github.io/lolbas/Binaries/Atbroker/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_atbroker_uncommon_ats_execution.yml","techniques":["T1218"],"cves":[]},{"id":"f37aba28-a9e6-4045-882c-d5004043b337","title":"Potential Arbitrary File Download Via Cmdl32.EXE","author":"frack113","status":"test","level":"medium","date":"2021-11-03","modified":"2024-04-22","description":"Detects execution of Cmdl32 with the \"/vpn\" and \"/lan\" flags.\nAttackers can abuse this utility in order to download arbitrary files via a configuration file.\nInspect the location and the content of the file passed as an argument in order to determine if it is suspicious.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Cmdl32/","https://twitter.com/SwiftOnSecurity/status/1455897435063074824","https://github.com/LOLBAS-Project/LOLBAS/pull/151"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1218","attack.t1202"],"path":"rules/windows/process_creation/proc_creation_win_cmdl32_arbitrary_file_download.yml","techniques":["T1218","T1202"],"cves":[]},{"id":"f3d39c45-de1a-4486-a687-ab126124f744","title":"Sdiagnhost Calling Suspicious Child Process","author":"Nextron Systems, @Kostastsale","status":"test","level":"high","date":"2022-06-01","modified":"2024-08-23","description":"Detects sdiagnhost.exe calling a suspicious child process (e.g. used in exploits for Follina / CVE-2022-30190)","references":["https://twitter.com/nao_sec/status/1530196847679401984","https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e","https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/","https://app.any.run/tasks/f420d295-0457-4e9b-9b9e-6732be227583/","https://app.any.run/tasks/c4117d9a-f463-461a-b90f-4cd258746798/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1036","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_sdiagnhost_susp_child.yml","techniques":["T1036","T1218"],"cves":[]},{"id":"f65e22f9-819e-4f96-9c7b-498364ae7a25","title":"Potential RemoteFXvGPUDisablement.EXE Abuse","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-07-13","modified":"2023-05-09","description":"Detects PowerShell module creation where the module Contents are set to \"function Get-VMRemoteFXPhysicalVideoAdapter\". This could be a sign of potential abuse of  the \"RemoteFXvGPUDisablement.exe\" binary which is known to be vulnerable to module load-order hijacking.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1"],"logsource":{"product":"windows","service":"powershell-classic"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/powershell/powershell_classic/posh_pc_remotefxvgpudisablement_abuse.yml","techniques":["T1218"],"cves":[]},{"id":"f9999590-1f94-4a34-a91e-951e47bedefd","title":"Suspicious Provlaunch.EXE Child Process","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-08-08","modified":null,"description":"Detects suspicious child processes of \"provlaunch.exe\" which might indicate potential abuse to proxy execution.","references":["https://lolbas-project.github.io/lolbas/Binaries/Provlaunch/","https://twitter.com/0gtweet/status/1674399582162153472"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_provlaunch_susp_child_process.yml","techniques":["T1218"],"cves":[]},{"id":"fa1a7e52-3d02-435b-81b8-00da14dd66c1","title":"Diskshadow Script Mode - Execution From Potential Suspicious Location","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-09-15","modified":"2024-03-05","description":"Detects execution of \"Diskshadow.exe\" in script mode using the \"/s\" flag where the script is located in a potentially suspicious location.","references":["https://bohops.com/2018/03/26/diskshadow-the-return-of-vss-evasion-persistence-and-active-directory-database-extraction/","https://www.ired.team/offensive-security/credential-access-and-credential-dumping/ntds.dit-enumeration","https://medium.com/@cyberjyot/lolbin-execution-via-diskshadow-f6ff681a27a4","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/diskshadow","https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf","https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware","https://research.checkpoint.com/2022/evilplayout-attack-against-irans-state-broadcaster/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_diskshadow_script_mode_susp_location.yml","techniques":["T1218"],"cves":[]},{"id":"fb0b815b-f5f6-4f50-970f-ffe21f253f7a","title":"Potential DLL Sideloading Activity Via ExtExport.EXE","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2021-11-26","modified":"2024-08-26","description":"Detects the execution of \"Extexport.exe\".A utility that is part of the Internet Explorer browser and is used to export and import various settings and data, particularly when switching between Internet Explorer and other web browsers like Firefox. It allows users to transfer bookmarks, browsing history, and other preferences from Internet Explorer to Firefox or vice versa.\nIt can be abused as a tool to side load any DLL. If a folder is provided in the command line it'll load any DLL with one of the following names \"mozcrt19.dll\", \"mozsqlite3.dll\", or \"sqlite.dll\".\nArbitrary DLLs can also be loaded if a specific number of flags was provided.\n","references":["https://lolbas-project.github.io/lolbas/Binaries/Extexport/","https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/","https://www.microsoft.com/en-us/security/blog/2020/03/23/latest-astaroth-living-off-the-land-attacks-are-even-more-invisible-but-not-less-observable/","https://res.armor.com/resources/threat-intelligence/astaroth-banking-trojan/","https://securelist.com/the-tetrade-brazilian-banking-malware/97779/","https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_extexport_execution.yml","techniques":["T1218"],"cves":[]},{"id":"fbd7c32d-db2a-4418-b92c-566eb8911133","title":"SyncAppvPublishingServer Execute Arbitrary PowerShell Code","author":"frack113","status":"test","level":"medium","date":"2021-07-12","modified":"2022-10-04","description":"Executes arbitrary PowerShell code using SyncAppvPublishingServer.exe.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md","https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_execute_psh.yml","techniques":["T1218"],"cves":[]},{"id":"fc014922-5def-4da9-a0fc-28c973f41bfb","title":"Execution DLL of Choice Using WAB.EXE","author":"oscd.community, Natalia Shornikova","status":"test","level":"high","date":"2020-10-13","modified":"2023-08-17","description":"This rule detects that the path to the DLL written in the registry is different from the default one. Launched WAB.exe tries to load the DLL from Registry.","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OSBinaries/Wab.yml","https://twitter.com/Hexacorn/status/991447379864932352","http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/registry/registry_set/registry_set_wab_dllpath_reg_change.yml","techniques":["T1218"],"cves":[]},{"id":"fe5ce7eb-dad8-467c-84a9-31ec23bd644a","title":"SyncAppvPublishingServer Bypass Powershell Restriction - PS Module","author":"Ensar Şamil, @sblmsrsn, OSCD Community","status":"test","level":"medium","date":"2020-10-05","modified":"2022-12-02","description":"Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.","references":["https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1218"],"path":"rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml","techniques":["T1218"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2021-44077","state":"mapped","mapping_types":["secondary_impact"]},{"cveID":"CVE-2021-40539","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}