Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Detects function calls from the EditionUpgradeManager COM interface. Which is an interface that is not used by standard executables.
Detects the pattern of UAC Bypass using a WoW64 logger DLL hijack (UACMe 30)
This rule detects suspicious activity where a non-browser process attempts to decrypt credentials stored by Google Chrome or Microsoft Edge using DPAPI (Data Protection API). This could indicate an adversary attempting to steal stored browser credentials.
Detects a Python process attempting to read the memory (`/proc/<pid>/mem` or `/maps`) of a GitHub Actions `Runner.Worker` process. This is indicative of the credential dumping technique used by the TeamPCP threat actor during the Trivy supply chain compromise to extract highly privileged injected secrets.
Detects 'Early Bird' Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes. This technique involves a suspicious parent process (like a script interpreter) creating a suspended 'explorer.exe' process, then injecting malicious code using API calls such as 'QueueUserAPC' and 'WriteProcessMemory' before the process fully starts. This rule specifically looks for the combination of these events within a short timeframe.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
This detection identifies activity related to .NET Process Hollowing, specifically focusing on the use of InstallUtil.exe as the target process. It triggers when InstallUtil.exe attempts to access a source image located in a user's AppData or Temp directory, with a file extension of .exe or .bin. This behavior is indicative of a specific threat intelligence report detailing process hollowing techniques involving InstallUtil.exe. A match suggests a strong reason for investigation, as it aligns with published threat reporting, though it does not confirm compromise or success of the activity.
Detects a process requesting read access (GrantedAccess 0x1010) to the LSASS process memory (lsass.exe). This technique is commonly used by threat actors to dump credentials for lateral movement and ransomware deployment. The rule specifically looks for the GrantedAccess value '0x1010', which corresponds to PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access rights, and excludes a list of known legitimate processes.
Detects tools like Mimikatz, NanoDump, Procdump, or Invoke-Mimikatz accessing the LSASS process with specific memory read permissions (PROCESS_VM_READ). This detection relies on Sysmon Event ID 10 and filters out legitimate svchost.exe access to LSASS.
Malware often tries to hide inside programs that users trust. In this attack, it runs its code inside Windows apps like OneDrive, RuntimeBroker, or similar system processes. These apps are signed by Microsoft and run in the background, so they attract less attention. The malware uses PowerShell to put its code into those processes. Once inside, the malicious code runs as if it were part of the trusted app. This makes it harder for security tools and users to spot. Normal use of these apps does not involve PowerShell accessing them in this way. Security teams should treat PowerShell or a renamed PowerShell accessing these specific processes as a strong sign of an attack. This rule helps detect that behaviour.
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects behavior consistent with an AMSI bypass where the AmsiScanBuffer function is located and patched in memory to always return an error. This technique disables script content scanning and is commonly used by post-exploitation frameworks and staged malware payloads.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Page 26 of 32