Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects Atlas RAT and ValleyRAT patterns involving process injection into svchost.exe or explorer.exe by an unauthorized process originating from a user-writable directory (e.g., Temp, AppData, Downloads). The rule correlates process injection events with preceding suspicious process launches.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Detects cross-process injection activity targeting Internet Explorer related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for unauthorized processes that are not signed by trusted publishers (Microsoft, Google, Mozilla) performing injection-like behavior, typically associated with Remcos RAT and its use of techniques such as process hollowing or thread execution hijacking.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.
This rule detects attempts to inject code into or patch the Anti-Malware Scan Interface (AMSI) DLL (amsi.dll). It monitors for Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) initiated by suspicious processes like PowerShell or scripting hosts where the target is amsi.dll or where amsi.dll is being accessed in a way consistent with memory patching or hooking, aiming to bypass endpoint security scanning capabilities.
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
Page 13 of 21