Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
This rule detects suspicious process injection activity characterized by a sequence of API calls (VirtualAlloc, CreateRemoteThread, WriteProcessMemory) in conjunction with the loading of 'mpr.dll'. This combination of events can indicate an attempt to inject malicious code into a process, potentially for evasion or privilege escalation. The rule filters out common legitimate processes to reduce false positives.
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
Detects potential process injection into Google Chrome processes using Asynchronous Procedure Calls (APC) or remote thread creation. This rule specifically looks for Chrome processes launched with specific command-line arguments (indicating a potentially controlled or sandboxed environment) that then have remote API calls like QueueUserApcRemoteApiCall, CreateRemoteThreadApiCall, or NtQueueApcThreadApiCall targeting them, originating from a different process. The AdditionalFields check for 'CryptUnprotectMemory', 'NtTestAlert', or 'NtQueueApcThreadEx2' further refines the detection of suspicious APC-related activities.
Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
Page 16 of 21