Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
Identifies the implant injecting threads into explorer.exe to mask outbound network traffic, specifically when the initiating process is 'setup.exe'.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects PE injection technique using NtUnmapViewOfSection
Detects process injection attempts targeting the OneDrive.Sync.Service.exe process. This behavior is associated with the OceanLotus SPECTRALVIPER backdoor, which uses it to maintain persistence and evade defense mechanisms.
Detects DLL injection using LoadLibraryA/W API calls
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects rundll32.exe or dllhost.exe performing remote thread injection into web browser processes (chrome.exe, msedge.exe, firefox.exe). This activity is often associated with defense evasion and credential theft staging, as observed in campaigns like ClearFake/ClickFix, before a full Remote Access Trojan (RAT) is established.
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Detects remote thread creation from CACTUSTORCH as described in references.
Detects a remote thread creation of Ttdinject.exe used as proxy
Detects the creation of a remote thread from a Powershell process in an uncommon target process
Detects uncommon processes creating remote threads.
Detects uncommon processes creating remote threads.
Detects uncommon target processes for remote thread creation
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
Detects process hollowing of tracerpt.exe, a technique used by the Valley RAT malware (associated with Silver Fox APT) to execute downloaded plugins. The rule identifies the creation of tracerpt.exe in a suspended state, followed by the creation of a remote thread within it, which is a strong indicator of code injection.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Page 18 of 21