Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
Detects techniques used to perform credential dumping from the LSASS process memory, including the use of comsvcs.dll via rundll32, the procdump utility, and unauthorized process handle requests (OpenProcess) targeting lsass.exe.
Detects abuse of native Windows API calls for process injection and execution
Detects high-privilege access to the LSASS process (lsass.exe), commonly associated with credential dumping techniques such as LSASS memory reading. The rule monitors for specific process access masks (0x1010 and 0x1fffff) originating from non-system, non-security tool processes.
Detects potential Asynchronous Procedure Call (APC) injection by monitoring for processes running from user-writable directories that request broad access (PROCESS_ALL_ACCESS) to other processes, or by detecting the initiation of QueueUserAPC or NtQueueApcThread remote thread creation.
Detects sandbox evasion behavior where a process enumerates virtual machine-specific registry keys (e.g., VirtualBox, VMware) or attempts to access known virtualization service processes. This pattern is characteristic of malware attempting to identify if it is running in an analysis environment to alter its behavior.
Detects the SNOWLIGHT dropper performing an Antimalware Scan Interface (AMSI) bypass. The rule identifies processes that load 'amsi.dll' and subsequently perform memory manipulation (WriteProcessMemory or VirtualProtect) on the module's memory region within a 10-second window, excluding known Windows security components.
Detects Grixba infostealer execution from the C:\Users\Public\Music\ staging path, identified by the creation of RWX (PAGE_EXECUTE_READWRITE) memory regions and the registration of Vectored Exception Handlers (VEH). These behaviors are indicative of advanced process injection techniques used during the preparation phase of malware execution, often associated with the Play Ransomware group.
Detects cross-process activity (such as process injection or handle access) initiated by the Windows Update service (wusvc.exe) where the executable is not digitally signed by Microsoft Corporation. This behavior is highly suspicious as the legitimate wusvc.exe should always be signed by Microsoft, and this may indicate process masquerading or a compromised service binary.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls within a 5-minute window.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects attempts by processes identified as Remcos RAT or its loader (GST*.com) to access Local Security Authority (LSA) secrets. This activity is indicative of credential dumping, where an attacker tries to extract sensitive authentication material from the system.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects unauthorized attempts to terminate security-related processes using direct syscalls (ZwTerminateProcess). The rule monitors for processes attempting to access AV/EDR security products with high-level access rights (0x0001 or 0x1fffff) while excluding authorized security processes themselves.
This rule detects cross-process memory access events (Sysmon Event ID 10) where a process attempts to hook into keyboard-related Windows API functions such as SetWindowsHookEx, GetKeyState, or GetAsyncKeyState. It further filters for processes executing from suspicious locations (Temp, AppData, ProgramData) or those that are unsigned/unverified, which are common indicators of malicious keylogging or spyware activity.
Page 19 of 32