Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
5
5
3
2
1
Contributors
7
2
2
2
1
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
15
1
Products / Services
9
5
3
1
MITRE Techniques
13
6
4
3
2
Detects suspicious process-injection related API calls (such as CreateRemoteThread, VirtualAllocEx, and WriteProcessMemory) where the source or target process is a common AI agent runtime environment (e.g., python.exe, node.exe, java.exe, dotnet.exe). This detects potential malicious code execution or reflective loading initiated by or targeting these runtime processes.
Detects Sysmon Event ID 10 (ProcessAccess) events where a process opens lsass.exe with a GrantedAccess mask matching known credential-dumping access rights (e.g. PROCESS_VM_READ combinations used by Mimikatz/ProcDump-style tooling), excluding common legitimate EDR/AV/diagnostic source processes.
Detects sophisticated process injection behavior where malicious shellcode is mapped into RWX memory. The payload utilizes a Vectored Exception Handler (VEH) and deliberate 0xCC (breakpoint) instructions to intercept execution and redirect it into raw syscall stubs (e.g., NtProtectVirtualMemory). This technique is designed to bypass security product API hooking by avoiding standard calls to memory protection functions.
Detects processes registering a Vectored Exception Handler (VEH) while simultaneously performing memory write operations and thread context modifications. This behavior is highly indicative of advanced process injection techniques, such as using VEH as a redirection mechanism to execute raw syscalls or malicious shellcode within a target process.
Detects the ERAAgent.exe process creating raw sockets (SOCK_RAW) and enabling promiscuous mode (SIO_RCVALL) on a non-loopback interface while lacking corresponding listening port activity. This behavior is indicative of passive magic-packet sniffing, often associated with the SLEEPWALKER backdoor/trojan.
Detects direct raw access to the primary physical disk device (PhysicalDrive0) on Windows systems. This behavior is often associated with ransomware or wiper malware attempting to overwrite the Master Boot Record (MBR) or partition table to render the system unbootable.
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Detects attempts by processes to gain raw read/write access to the physical disk (PhysicalDrive0), which is a common technique used by wiper malware to overwrite the Master Boot Record (MBR) and render the system unbootable.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
This rule detects potential tampering with security agents by monitoring for the load of suspicious drivers (Sysmon Event ID 6) immediately followed by the termination of known security software processes (Sysmon Event ID 5) or signs of security service disability (Windows Security Center 5004) or unauthorized raw disk access (Sysmon Event ID 9). This behavior is often indicative of an adversary attempting to bypass EDR or AV solutions by loading a malicious kernel driver to blind them.
Detects suspicious kernel-level activity following a potential privilege escalation event on Linux systems. The rule monitors for unauthorized kernel module loading (via non-standard paths) or direct write access to /dev/kmem, which is indicative of rootkit installation or kernel-level memory manipulation.
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
This rule detects suspicious memory manipulation and thread injection activities directed at 'svchost.exe' or 'explorer.exe' by processes other than standard system components. Such behavior is often indicative of malicious code injection, where an attacker attempts to run arbitrary code within the address space of trusted system processes to bypass security controls or achieve persistence.
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
Detects raw disk access attempts by uncommon tools or tools located in suspicious directories. This activity could indicate defense evasion, potentially to bypass file system monitoring or access controls.
Detects raw disk access using uncommon tools or tools that are located in suspicious locations (heavy filtering is required), which could indicate possible defense evasion attempts
