Every published rule

Linux Bun Runtime Execution: bun_environment.js via node-parent process

Flags /node-launched /bun executions running bun_environment.js with an external runner release download URL.

Windows Setup16.EXE Execution Triggered by Custom .LST File

Flags Windows Setup16.EXE being invoked with ' -m ' from its system parent process, potentially tied to custom .lst-driven execution.

Windows: Suspicious rundll32 Execution of Non-DLL Extension via Living-off-the-Land Parent Processes

Flags rundll32.exe executions from common script parents where the command line references known drop locations but lacks standard extensions.

Windows PingCastle Execution From Suspicious Parent Processes

Alerts on PingCastle (PingCastle.exe) being run with full scan/healthcheck arguments from potentially suspicious parent process locations.

Windows Process Creation Signals for Pikabot System Discovery

Flags process-launch discovery commands (ipconfig/netstat/whoami) under rundll32 and Search host parent processes on Windows.

DarkGate-related Autoit3.exe execution with suspicious parent process (Windows)

Alerts on AutoIt3.exe execution when spawned from cmd.exe, KeyScramblerLogon.exe, or msiexec.exe, excluding common legitimate install paths.

Windows Diskshadow.exe Child Process Execution

Alerts when Diskshadow.exe is the parent process of a newly created process on Windows.

Linux: Shell Execution from /tmp by Parent Process

Alert when a /tmp parent process spawns a shell (bash/sh/zsh/etc.), indicating likely staging and command execution.

Windows Scripting Engines Spawning regsvr32.exe via Parent Process Execution

Flags common script/command interpreters launching regsvr32.exe on Windows, a potential proxy execution behavior.

Windows Qakbot-associated Rundll32 execution via suspicious parent process and export strings

Flags rundll32.exe executions tied to Qakbot-style export strings when launched by script/cmd utilities.

Windows RDP client Mstsc.EXE launched from uncommon browser or email parent process

Alerts when mstsc.exe is spawned by a browser or Outlook, suggesting potential RDP access using a local .rdp file.

Windows: driverquery.exe Usage for Installed Driver Recon

Alerts when driverquery.exe (drvqry.exe) is launched by script-based parent processes to enumerate installed drivers.

Windows: Elevated PowerShell or CMD Spawned from Uncommon Parent Location

Alerts on elevated PowerShell/CMD executions whose parent process comes from uncommon Windows locations, indicating likely privilege escalation.

Windows: Suspicious Msbuild.exe execution from uncommon parent process

Alerts when Msbuild.exe runs under an unexpected parent process on Windows.

Windows: conhost.exe spawned by uncommon parent process

Alerts on conhost.exe launched by an uncommon parent process, using process creation parent image and command-line context.

Windows: Suspicious Parent Process Spawning cmd.exe

Alerts on cmd.exe executions that have a suspicious/atypical parent process among listed Windows binaries.

Windows Process Creation: Uncommon Parent Process Launching link.exe

Alerts when link.exe is spawned with a parent process outside typical Visual Studio paths.

Windows: Suspicious CustomShellHost.exe execution spawned by non-Explorer parent

Alerts on CustomShellHost.exe executions where explorer.exe is not the expected parent process image.

Windows Process: Notepad++ GUP (GUP.exe) Download Execution via -unzipTo and URL

Detects Notepad++ GUP.exe downloading over HTTP initiated by a non-Notepad++ parent process.

Linux Java Process Launching Suspicious Shell and Scripting Children

Alerts when a Java parent process launches shell or downloader/scripting tools on Linux.