Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
Detects Remcos RAT using process hollowing to inject into the default browser executable. The loader chain originates from a TuglaInsaatci-masquerading executable and passes through in-memory DLL stages (Optimax.dll / System Optimizer Ultimate.dll) before hollowing the browser. The Remcos_Mutex_Inj mutex confirms successful injection into the browser process.
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
Detects cross-process activity (OpenProcess or CreateRemoteThread) targeting critical system processes (svchost.exe, explorer.exe, or rundll32.exe) from suspicious or unexpected parent processes. The rule aggregates multiple events over a short time window to reduce noise and applies a risk-based scoring system based on the injector file location.
Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.
Detects the SharkLoader 'Perfect DLL Hijacking' technique where SystemSettings.exe loads a malicious DLL from user-writable AppData directories and then manipulates LdrpLoaderLock to spawn a malicious thread. This is identified by SystemSettings.exe loading DLLs from specific AppData subfolders (e.g., xwreg, xgdf) and subsequently creating a remote or local thread.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Detects the Chromelevator loader, identified as 'drun.exe', performing reflective DLL injection of 'payload.dll' using direct syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) and inter-process communication (IPC) via a named pipe ('__DLL_PIPE_COMPLETION_SIGNAL__'). The rule looks for process creation, remote thread creation, memory protection modifications, file creation/modification of 'payload.dll', and specific named pipe events associated with 'drun.exe'.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
This rule detects cross-process memory allocation, memory writing, and thread creation activities targeting critical Windows processes like svchost.exe or explorer.exe. Such actions are commonly utilized by attackers for code injection (e.g., Payouts King tradecraft) to execute arbitrary code within the context of trusted processes, enabling evasion or persistence.
Infostealer distributed via fake open-source tool impersonation sites
Photo-themed ZIP phishing campaign dropping a Node.js implant
Infostealer-as-a-service targeting browser credentials and crypto wallets
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Latin American banking trojan using DLL side-loading and overlay attacks
Detects suspicious screen capture activity by non-UI processes. This rule identifies instances where a process invokes GDI BitBlt/PrintWindow or CopyFromScreen APIs, followed by writing a JPEG screenshot file to disk, particularly from temporary or program data folders. This behavior is consistent with infostealers like StealC and Amadey.
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Page 12 of 21