Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized attempts to access or dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors for execution of known credential-dumping tools (e.g., secretsdump), cross-process access to lsass.exe, suspicious process command-line arguments (e.g., comsvcs, MiniDump), and the creation of files indicative of credential theft (e.g., lsass.dmp, wceaux.dll).
This rule detects attempts to access the Local Security Authority Subsystem Service (LSASS) process memory or the NTDS.dit file, which are common targets for credential dumping. It specifically looks for Security Event ID 4656 (A handle to an object was requested) where the ObjectName is either 'lsass.exe' or 'ntds.dit' and the AccessMask indicates read or all access permissions. The rule then summarizes these events by user, computer, and IP address, flagging if two or more such events occur.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects instances where browser processes (chrome.exe, msedge.exe, brave.exe, firefox.exe) access clipboard-related APIs via Sysmon Event ID 10. This behavior is indicative of potential malicious or unauthorized clipboard interaction, such as sensitive data harvesting or clipboard manipulation by automated agents or scripts.
Detects instances where browser processes (chrome.exe, msedge.exe, brave.exe, firefox.exe) access clipboard-related APIs via Sysmon Event ID 10. This behavior is indicative of potential malicious or unauthorized clipboard interaction, such as sensitive data harvesting or clipboard manipulation by automated agents or scripts.
Detects cross-process activity where an unsigned executable residing in common user-writable directories (AppData, Temp, ProgramData) attempts to interact with or inject into sensitive system processes (explorer.exe, svchost.exe, notepad.exe). This behavior is characteristic of malicious process injection attempts.
This rule detects two scenarios on Linux systems: 1. A non-root process interacting with a root process (e.g., cross-process communication where the source is non-root and the target is root). 2. Any process (excluding root) exhibiting indicators related to 'AF_ALG' or 'splice', or mentioning 'CVE-2026-31431' in its name or description. These indicators are often associated with privilege escalation attempts or kernel exploits.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects suspicious access to the Local Security Authority Subsystem Service (LSASS) process using granted access rights associated with credential dumping tools like Pillager and Cobalt Strike, commonly observed in StrikeShark campaigns.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Detects suspicious behavior associated with Remcos RAT, including UAC bypass techniques using ICMLuaUtil, process injection into system binaries, and persistence mechanism creation in the Windows registry.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects a non-system process that allocates executable memory (consistent with custom syscall stub staging) and subsequently opens a handle to the LSASS process. This behavior correlates the preparation of custom syscall stubs (often used to bypass user-mode API hooking) with the direct interaction with LSASS, which is a high-confidence indicator of credential dumping activity.
Detects the modification of the WDigest 'UseLogonCredential' registry value to 1 (enabling plaintext credential storage in memory) followed by subsequent access to the LSASS process, a common sequence in credential dumping attacks.
Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Page 17 of 32