Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule detects suspicious process access or remote thread creation events where AdgNsy.exe interacts with WAB.exe (Windows Address Book). Such activity is indicative of potential process injection or unauthorized memory access to steal contact data or manipulate process memory.
Detects unauthorized credential dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies suspicious use of system utilities like 'comsvcs.dll' via rundll32, cross-process handle access by unauthorized processes, and the execution of offensive security tools such as lsassy and crackmapexec.
Detects remote LSASS memory dumping using the built-in comsvcs.dll MiniDump functionality, invoked by rundll32.exe. This activity is consistent with tools like lsassy, which leverage techniques such as SMB service creation, WMI, scheduled tasks, and DCOM/MMC to execute the dump remotely. The rule monitors for command lines containing comsvcs.dll and MiniDump, targeting the LSASS process or staging files in the Windows Temp directory.
Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.
This rule monitors Windows Sysmon Event ID 10 (ProcessAccess) for suspicious activity where the CallTrace indicates the use of direct syscalls (bypassing standard Win32 DLL chain) or anomalous execution paths while targeting high-value processes such as security agents, system services, and critical infrastructure (e.g., lsass.exe, svchost.exe).
Detects instances where a Node.js process accesses, creates, or modifies sensitive files such as SSH private keys, AWS credentials, or application configuration files (.npmrc, .pypirc, .docker/config.json). This behavior is often indicative of credential theft or unauthorized configuration access by a compromised Node.js application.
This rule detects cross-process memory access events (Sysmon Event ID 10) where a process attempts to hook into keyboard-related Windows API functions such as SetWindowsHookEx, GetKeyState, or GetAsyncKeyState. It further filters for processes executing from suspicious locations (Temp, AppData, ProgramData) or those that are unsigned/unverified, which are common indicators of malicious keylogging or spyware activity.
This rule detects repeated access attempts (3 or more within an hour) to critical credential storage processes or files, specifically lsass.exe, the Security Account Manager (SAM) database, or the NTDS.dit file. Such activity is indicative of credential theft attempts by an adversary.
Detects network activity associated with the SPECTRALVIPER malware family attributed to OceanLotus (APT32). The rule monitors for connections to known malicious C2 infrastructure (IPs and domains) and behavioral anomalies where the 'OneDrive.Sync.Services.exe' process makes outbound network connections to non-private addresses, which is indicative of process injection.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) initiates a network connection to the loopback address (127.0.0.1 or ::1), excluding standard SMB traffic (Port 445). Such behavior by LSASS is highly anomalous and may indicate exploitation attempts, such as memory dumping or credential harvesting techniques involving inter-process communication.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
This rule detects potential clipboard data theft by monitoring Windows Sysmon Event ID 10 for process access events involving clipboard-related APIs (OpenClipboard, GetClipboardData) by untrusted processes, and PowerShell Script Block Logging (Event ID 4104) for the use of Get-Clipboard cmdlets. This identifies attempts by non-standard or unauthorized processes to access sensitive information copied by a user.
Detects attempts to access browser credential stores or LSASS process memory by unexpected processes. This rule identifies suspicious file access patterns to browser login data files (Chrome, Edge, Firefox, Brave) by non-browser executables, as well as unauthorized access to LSASS process memory via Sysmon Event ID 10 or Windows Security Event 4656 by non-system processes. These activities are indicative of credential dumping or theft.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
Detects suspicious behavior linked to the BeepRAT malware or related tooling (tcc.exe, LuaJit.exe). It monitors for the loading of GDI32 modules by these specific processes and identifies instances where these processes perform cross-process access to sensitive Windows system processes like explorer.exe or dwm.exe, which is indicative of process injection or defense evasion techniques.
Detects cross-process activity (OpenProcess or CreateRemoteThread) targeting critical system processes (svchost.exe, explorer.exe, or rundll32.exe) from suspicious or unexpected parent processes. The rule aggregates multiple events over a short time window to reduce noise and applies a risk-based scoring system based on the injector file location.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Page 15 of 32