Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
Detects instances where a process has been elevated on a Windows system, as indicated by specific log messages containing 'Process is elevated' within the command line or image file name fields.
Detects rapid, bulk process termination of critical system, security, database, and office applications using the Windows taskkill.exe utility. This behavior is characteristic of ransomware (such as DragonForce) attempting to release file locks prior to initiating encryption activities.
Detects evidence of SloppyRAT employing the Hell's Gate technique, specifically the resolution and indirect invocation of low-level NT system calls (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) designed to bypass EDR user-mode API hooking during process injection activities.
Detects potential reflective code loading or memory injection attempts within Python interpreter processes (pythonw.exe, ipy.exe). The rule monitors for processes that lack a valid module path or file path on disk while referencing known indicators of malicious memory-based loading, such as 'hostfxr.dll' or specific suspicious strings like 'DLLMemLoader'. This technique is often used to execute payloads directly in memory to evade file-based security controls.
This rule detects suspicious process activity in interpreters (ipy.exe, pythonw.exe) or rundll32.exe involving multiple, rapid consecutive calls to sensitive memory management and thread creation functions (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx). The logic specifically monitors for a high frequency of distinct, powerful Windows API calls, which is often indicative of reflective code injection or process hollowing, including techniques like 'Hell's Gate' or those associated with SloppyRAT, and accounts for potential .NET/hostfxr-related execution vectors.
This rule detects the execution of the Visual Studio Debugger (vsdbg.exe) from suspicious locations such as Downloads, Temp, or Desktop directories. Executing development tools from these user-writable directories is often indicative of an adversary attempting to use legitimate debugging tools to facilitate process injection or malicious activity. The rule excludes legitimate executions located within the official Microsoft Visual Studio installation directory.
Detects instances where a browser process (chrome.exe) accesses the microphone or camera within a 2-minute temporal window of communicating with 'gemini.google.com'. This rule is intended to identify potential unauthorized use of system peripherals in the context of an AI-agent session.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
Detects rapid AI agent state transitions (from 'think' to 'act') within Microsoft Edge processes, specifically identifying potential exploitation of the CVE-2026-55945 race condition vulnerability, which could be used to force the unauthorized execution of an injected prompt.
This rule detects system calls originating from unbacked, private, or unknown memory regions, which is a common indicator of reflective code loading or process injection techniques. It also flags suspicious call stacks where standard processes like PowerShell, rundll32, or .NET execute system calls on ntdll.dll from non-standard module memory.
Detects the use of Windows API functions associated with token impersonation, such as ImpersonateLoggedOnUser and DuplicateTokenEx, or the RevertToSelf function, which can be indicators of token theft or privilege escalation attempts by an adversary.
Detects anomalous clipboard activity where content is repeatedly replaced by cryptocurrency wallet address patterns (Bitcoin or Ethereum) within a short timeframe. This behavior is indicative of clipboard hijacking (clipjacking), a technique used by malware like EggJagger to substitute legitimate payment addresses with attacker-controlled addresses.
Detects network activity or command line parameters initiated by the Jarte text processor (Jarte.exe or GRrte.exe) originating from a JartePortable directory, indicating potential C2 activity involving the domain 'castanaksa.com' or the IP address '192.64.119.189'.
Detects instances where browser processes (chrome.exe or comet.exe) access multiple files in sensitive or unexpected directories (e.g., System32, /etc/, Documents) without an associated user click event. This activity often indicates potential malicious scripts or automated data collection running within the context of a browser process.
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
This rule detects suspicious process injection activity directed at Chrome or Edge browser processes, followed immediately by file access to sensitive browser data files like 'Login Data' or 'Cookies'. This pattern is indicative of an adversary attempting to steal credentials or session cookies from a user's web browser memory and disk storage.
Detects PowerShell attempts to perform remote process injection into potentially suspicious or sensitive processes (csc.exe, chrome.exe, msedge.exe, SearchIndexer.exe) by searching for command line arguments indicating the usage of Windows memory allocation or thread context manipulation APIs such as NtAllocateVirtualMemoryRemote and NtSetContextThreadRemote.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
This rule detects potential anti-debugging behavior characteristic of the ConfuserEx packer. It identifies processes that repeatedly poll for debugger presence (using APIs such as Debugger.IsAttached, Debugger.IsLogging, or CheckRemoteDebuggerPresent) at approximately 1-second intervals, culminating in a call to Environment.FailFast to terminate execution if a debugger is detected.
Detects instances where processes associated with Claude or Codex modify or create files within a plugin directory without a preceding legitimate installation or session command (such as 'install' or 'plugin add'). This behavior may indicate unauthorized plugin installation, persistence establishment, or malicious code injection into the development environment.
Page 14 of 84