Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects potential local privilege escalation activity involving AnyDesk. The rule monitors for malicious registry modifications (COM hijack), spawning of suspicious child processes by AnyDesk, creation of specific named-pipe artifacts, unsigned DLL loads from user-writable directories, and unauthorized cross-process injection, potentially linked to CVE-2026-20253.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
This rule monitors for Node.js processes accessing sensitive configuration files, environment files, or credential stores (such as AWS credentials). It also triggers when command line arguments or file contents contain patterns indicative of infostealer activity, including specific indicators related to the Polymarket campaign or credentials collection functions like Git or Docker credential harvesting.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
Detects suspicious cross-process access or injection activity targeting Internet Explorer-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for high-privileged access rights, non-standard source process paths, and the presence of memory-related API calls often associated with process hollowing or injection (e.g., ZwCreateSection, VirtualAlloc, SetThreadContext) in combination with repeated access attempts.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects instances where a process attempts to access the memory or control flow of a web browser (Chrome, Edge, Brave) using suspicious access rights (0x820), which correspond to PROCESS_VM_WRITE (allowing memory modification) and PROCESS_SUSPEND_RESUME (allowing thread suspension). This behavior is often indicative of process injection or hollowed execution attempts against browser processes.
Detects the initialization phase of the Operation DragonReturn DcRAT loader, specifically identifying the creation of a unique named global mutex (Global\ShitSetupOn26126k) which acts as a single-instance enforcement mechanism and is often associated with sandbox evasion techniques.
Detects cross-process injection attempts into the Windows system process 'svchost.exe' where the source process is either unsigned or lacks a verified Microsoft publisher. This pattern is commonly observed in malware payloads, such as DcRAT, attempting to hide malicious activity within a legitimate system process.
Detects suspicious process activity, module loading, and function calls indicative of the BeepRAT malware family. The rule monitors for keyboard hooking via SetWindowsHookEx, the presence of specific keylogger-related command-line arguments, and the execution or loading of files associated with BeepRAT lure binaries.
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
This rule detects attempts by the PowerShell process to bypass the Antimalware Scan Interface (AMSI) by patching the amsi.dll in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events targeting 'powershell.exe' where 'amsi.dll' has been loaded into the process's memory space. This technique is often used by malware, such as Potemkin Loader, to evade detection.
Detects instances where the Windows Error Reporting process (wermgr.exe) attempts to open files located within a Volume Shadow Copy path. This behavior is atypical and may indicate an attempt to access sensitive files from a shadow copy, a technique often used in credential dumping or discovery activities.
Detects OneDrive synchronization service processes or associated modules invoking suspicious token manipulation or privilege enumeration APIs, such as 'StealToken', 'Impersonate_ThisThread', or 'GetPrivileges'. This behavior is indicative of potential privilege escalation or process injection techniques disguised within legitimate cloud sync service processes.
Detects reflective process injection activity where the IntelAudioService.exe process opens a handle to the OneDrive.Sync.Service.exe process, potentially using XGU::Manager::ProcessReflector class methods to inject shellcode.
Detects JFMBackdoor malware performing process enumeration and network connection discovery. The rule triggers when fltMC.exe exhibits suspicious behavior, specifically invoking API functions such as CreateToolhelp32Snapshot, Process32First/Next (process enumeration) or GetExtendedTcpTable/UdpTable (network discovery), which is indicative of sideloading malicious DLLs (FLTLIB.dll) into the legitimate fltMC.exe process context.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects unauthorized or suspicious attempts to access the memory space of the Local Security Authority Subsystem Service (LSASS) process. The detection logic looks for specific access masks typically used by Mimikatz (0x1010 and 0x1fffff) or execution attempts from binaries renamed to mimic common Mimikatz naming conventions (g.com, hs.com, dump.com). This is intended to identify credential dumping activities.
Detects the use of SysmonEnte, a tool to attack the integrity of Sysmon
Page 13 of 32