Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects Vidar Stealer performing classic APC injection into a browser process (Chrome/Edge/Brave) using CreateRemoteThread with NtTestAlert as the thread start address and NtQueueApcThread to queue CryptUnprotectMemory for in-memory ABE v20_master_key decryption.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
Detects instances where non-browser processes attempt to open a handle to common web browsers (Chrome, Edge, Firefox). This behavior is indicative of unauthorized memory access or process injection techniques often used to harvest session cookies or other sensitive data stored in browser memory space.
Detects the creation of a mutex with a specific pattern used by the MonsterV2 malware, a sophisticated RAT, loader, and stealer.
Detects potentially malicious process execution behaviors, including the use of 'runas.exe' with saved credentials, the execution of 'runas.exe' by unauthorized users, and unauthorized cross-process access to sensitive Windows system processes such as lsass.exe, winlogon.exe, or services.exe, which are common indicators of credential access or privilege escalation attempts.
This rule detects cross-process operations (such as memory access or thread injection) initiated by processes that are not signed by known, trusted vendors, or that do not reside in protected system directories. This behavior is a common indicator of process injection techniques used to evade security controls.
This rule detects cross-process memory access attempts against the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by attackers to dump credentials (e.g., cleartext passwords, NTLM hashes, Kerberos tickets) for lateral movement and privilege escalation. The rule filters out known legitimate processes and system-signed components to reduce false positives.
Detects unauthorized or suspicious processes attempting to access the memory of the Local Security Authority Subsystem Service (lsass.exe). This activity often indicates attempts to dump process memory to harvest sensitive credentials, a common technique used by attackers to facilitate lateral movement.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects cross-process memory access attempts targeting the Local Security Authority Subsystem Service (lsass.exe). The rule filters out known Microsoft-signed system processes and common Windows binaries to identify potential unauthorized credential dumping activity.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
This rule detects attempts to unhook or tamper with Native APIs by monitoring 'WriteProcessMemory' calls targeting 'ntdll.dll'. This technique is often used by adversaries to evade EDR (Endpoint Detection and Response) solutions by disabling their API monitoring capabilities.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects suspicious activities within a Veeam backup environment, including unauthorized process spawning by Veeam services, LSASS memory access, destruction of backup catalogs or restore points via PowerShell, and unauthorized access to Veeam database files by non-Veeam processes.
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
Detects attempts to open the Local Security Authority Subsystem Service (LSASS) process with read permissions (specifically, PROCESS_VM_READ access) by non-system processes. This activity is often associated with credential dumping techniques.
Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects potential PPID spoofing and process injection activity associated with SharkLoader and Cobalt Strike. The rule monitors for cross-process injection into critical system processes or shell spawning from suspicious directories (AppData/Roaming or ProgramData/KasperskyLab), typically used by SharkLoader to stage payloads or perform parent process spoofing.
Detects common credential dumping techniques targeting the LSASS process or NTDS.dit database, including the use of known dump utilities such as Procdump, Rundll32 with comsvcs.dll, and Ntdsutil, as well as unauthorized process access to LSASS.
Page 22 of 32