Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects instances where a process spawns a child process using the exact same executable image path, specifically when the executable is located in user-writable directories such as Downloads or AppData\Local\Temp. This behavior is a common indicator of process hollowing or self-injection techniques used by malware, such as loaders that decrypt payloads in memory and then spawn a new, hollowed instance of themselves to execute the malicious code, frequently observed during post-exploitation activities.
Detects reflective or beacon-style in-memory process injection where an injection-type action occurs in a target process, but no corresponding file creation event is recorded by the initiating process. This behavior is indicative of fileless malware loaders or reflective COFF-based execution, commonly used in adversary techniques like BOF (Beacon Object File) execution to bypass static disk-based security controls.
Detects the execution of 'vsdbg.exe' or 'vsdbg.dll' from locations outside of the legitimate Microsoft Visual Studio installation directories. This behavior is indicative of potentially malicious usage of the Visual Studio debugger components for process injection or evasion.
Detects anomalous, high-frequency access to clipboard APIs (GetClipboardData/SetClipboardData) by non-standard, unrecognized processes. The rule specifically monitors for patterns consistent with clipper malware, which polls the clipboard for cryptocurrency address formats and replaces them with attacker-controlled addresses.
Detects network connection events initiated by known beaconing-related process names. These processes are associated with command and control infrastructure or pivot nodes often used by adversaries for post-compromise activity.
Detects instances where the Node.js runtime environment (node.exe) deletes a file named 'sharedLoad.min.js' located within a 'node_modules' directory. This behavior is indicative of anti-forensic cleanup activities where malicious npm packages attempt to remove their own footprints or temporary artifacts post-execution.
This rule detects potential DLL sideloading activity where legitimate, signed binaries (such as COTFileReadApp.exe or DeElevate64.exe) are executed from non-standard directories (e.g., AppData, Temp, Downloads) while loading specifically identified malicious or sideloaded DLLs. The detection identifies patterns where these binaries operate outside their expected vendor installation paths, indicating a likely attempt to hijack execution flow.
This rule detects potential DLL sideloading activity where legitimate, signed binaries (such as COTFileReadApp.exe or DeElevate64.exe) are executed from non-standard directories (e.g., AppData, Temp, Downloads) while loading specifically identified malicious or sideloaded DLLs. The detection identifies patterns where these binaries operate outside their expected vendor installation paths, indicating a likely attempt to hijack execution flow.
This rule detects potential DLL sideloading activity where legitimate, signed binaries (such as COTFileReadApp.exe or DeElevate64.exe) are executed from non-standard directories (e.g., AppData, Temp, Downloads) while loading specifically identified malicious or sideloaded DLLs. The detection identifies patterns where these binaries operate outside their expected vendor installation paths, indicating a likely attempt to hijack execution flow.
This rule detects potential DLL sideloading activity where legitimate, signed binaries (such as COTFileReadApp.exe or DeElevate64.exe) are executed from non-standard directories (e.g., AppData, Temp, Downloads) while loading specifically identified malicious or sideloaded DLLs. The detection identifies patterns where these binaries operate outside their expected vendor installation paths, indicating a likely attempt to hijack execution flow.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Detects unauthorized code injection attempts into web browser processes (chrome.exe, msedge.exe) by non-browser related processes. This behavior involves using APIs like CreateRemoteThread, NtAllocateVirtualMemory, or NtWriteVirtualMemory to modify memory and execute remote threads, which is a common technique used by information stealers such as LummaC2 to bypass browser security controls.
Detects a sequence of API calls (NtAllocateVirtualMemory, WriteProcessMemory, and CreateRemoteThread) targeting browser processes (chrome.exe, msedge.exe) from a non-browser process, consistent with shellcode injection patterns used by the Remus infostealer to bypass browser security features.
This rule monitors for suspicious activity related to Component Object Model (COM) objects, including registry modifications (creation, setting, or checking of specific CLSIDs related to shell links or WMI locators) in conjunction with process-level alerts (such as Remote Thread API calls, primary token modification, or WMI activity). It specifically filters out known benign system processes to focus on anomalous behavior that may indicate COM hijacking, persistence, or lateral movement.
ChainScript file manager 'files' task: node.exe performing high-volume recursive deletion within masqueraded ChainScript installation paths (drive enumeration, dir listing, file read/write, recursive delete)
Detects Android device management (MDM) components (specifically 'com.corp.mdm') re-launching registration or sticky services upon system events such as boot completion, quick-boot, or package updates. This monitoring is intended to identify persistent components that maintain functionality across device restarts.
Detects a specific loader sequence associated with the DarkMe malware/Water Hydra threat actor. The rule monitors for the execution of rundll32.exe with the /sta flag and a specific CLSID, followed by the presence or execution of targeted applications (cryptocurrency wallets, password managers, and system utilities) within a 15-minute timeframe. This sequence is indicative of the malware enumerating potential targets on the infected host before proceeding with malicious activity.
Detects potential process injection attempts (e.g., Early Bird APC injection or process hollowing) where a process is spawned in a suspended state, followed shortly by a remote-thread or QueueUserAPC injection primitive targeting that same process. The rule correlates process creation events with subsequent API calls while excluding known legitimate patterns like .NET runtime operations, system updaters, and EDR/AV security components.
Detects anomalous, high-frequency interaction with the Windows clipboard by explorer.exe. This activity is often associated with unauthorized data collection or exfiltration attempts by malware residing within or masquerading as the Windows shell.
Detects potential process injection attempts by unidentified executable files originating from suspicious directories (AppData or Temp) targeting critical system or service processes (e.g., explorer.exe, svchost.exe). The rule monitors CreateRemoteThread events and excludes signed dotnet host processes, characteristic of Hannibal Stealer behavior.
This rule detects instances where AutoIt (AutoIt3.exe) is observed performing process injection or launching suspicious binaries (RegSvcs.exe or mobsync.exe). Attackers frequently use AutoIt for process automation and to execute malicious payloads, and leveraging legitimate binaries like RegSvcs.exe is a known technique for bypassing defenses.
Page 10 of 84