Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule detects potentially malicious process discovery or memory access behavior. It triggers when processes perform frequent calls to common process enumeration APIs (e.g., CreateToolhelp32Snapshot, NtQuerySystemInformation) or when any process gains access to the Windows Update service (wusvc.exe), which is often used as a target for process injection or hollowing.
This rule monitors for the usage of the Windows API function 'SetWindowsHookEx' with the hook type 'WH_KEYBOARD_LL' (hook type 13), which is a common technique used by keyloggers and spyware to intercept keystrokes at the system level. The detection triggers when this API call is observed within process execution or API call traces.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects a potential security software enumeration behavior consistent with the SNOWLIGHT dropper, where a process rapidly requests access (EventID 10) to multiple known security tool processes in a short period.
Detects modifications to the memory protection flags of the ntdll.dll library to PAGE_READWRITE (0x04). This behavior is commonly associated with shellcode injection, hooking, or patching of core system libraries to facilitate malicious activity or evasion.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects the iterative XOR decryption routine signature used to decode the Donut payload in memory prior to execution, specifically looking for large memory write operations initiated by 'setup.exe'.
Correlates processes executing from the Public directory utilizing VirtualAllocEx to allocate PAGE_EXECUTE_READWRITE memory, a precursor to process hollowing.
Detects the MYRA RAT using memfd_create and fexecve to execute a Rust payload entirely in memory without writing an executable to disk, as observed in the Operation Friday Harvest npm supply chain campaign. The rule looks for process events where the action type indicates process creation, memory allocation, or process access, or where the FolderPath starts with '/proc/' and contains '/fd/'. It specifically targets initiating processes named 'node' or 'npm' or those with command lines associated with npm post-installation scripts. Further filtering is applied to FolderPaths matching the '/proc/\d+/fd/\d+' regex or ProcessCommandLines containing 'memfd_create' or 'fexecve', or FolderPaths containing 'memfd'.
Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.
Detects cross-process activity originating from the 'nvdaHelperRemote.dll' library targeting 'svchost.exe'. This pattern is indicative of potential process injection where a malicious actor or suspicious process attempts to inject code or manipulate the memory space of a core Windows system process via this specific helper library.
This rule detects advanced evasion techniques involving the patching of Native APIs (specifically WriteProcessMemory on ntdll.dll) combined with the spawning of suspended processes (process hollowing). This combination is indicative of attempts to unhook EDRs and execute malicious code stealthily.
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Traces the behavior of Vidar resolving its Win32 APIs dynamically in memory using a byte-by-byte XOR reconstruction loop. This rule specifically looks for `WriteProcessMemoryApiCall` events where the target process is `RegAsm.exe` and the buffer size written is less than 256 bytes, which is indicative of small, dynamic code injection or modification often seen in malware unpacking or API resolution.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, a known evasion tactic to blind EDR telemetry before full execution. This rule specifically looks for WriteProcessMemory API calls targeting memory regions near the base address of ntdll.dll, initiated by processes like InstallUtil.exe, MSBuild.exe, or powershell.exe.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects the threat actor utilizing the TiFlux backdoor access to run credential dumping tools (Mimikatz, Procdump) against LSASS.
Detects cross-process access to the Local Security Authority Subsystem Service (LSASS) memory by processes that are not standard Microsoft-signed system components. This behavior is often indicative of credential dumping activity using tools like Mimikatz or other custom malicious utilities attempting to read sensitive memory contents.
Detects a component combining spooler token access and CreateProcessAsUser, often indicative of the Sprysocks malware. The rule specifically looks for the presence of 'spoolsv.exe' along with API calls 'OpenProcessToken', 'DuplicateTokenEx', and 'CreateProcessAsUser', which are used to elevate privileges or impersonate other users by duplicating a token from the print spooler service and then launching a new process with that token.
Detects instances where an unsigned or non-trusted process attempts to access the memory of the Local Security Authority Subsystem Service (LSASS). Accessing LSASS memory is a common technique used by threat actors to harvest credentials for lateral movement and privilege escalation.
Detects instances where non-browser processes attempt to open a handle to common web browsers (Chrome, Edge, Firefox). This behavior is indicative of unauthorized memory access or process injection techniques often used to harvest session cookies or other sensitive data stored in browser memory space.
Page 23 of 32