Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
This rule detects the use of the CreateRemoteThread API in conjunction with the LoadLibrary function to inject a DLL into another process. Specifically, it looks for events where a remote thread is created, the starting module is 'kernel32.dll', and the starting function is 'LoadLibraryA'. This combination is a common technique for dynamic-link library (DLL) injection, often used by malware to execute arbitrary code within the context of a legitimate process, evade defenses, and potentially elevate privileges.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". This is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
Detects potential remote thread creation with specific start addresses often associated with Cobalt Strike beacons, indicating process injection activity.
This rule detects the creation of remote threads by a specific list of uncommon processes. These processes are often legitimate Windows executables or common applications that are not typically expected to create remote threads in other processes. Such activity can be indicative of process injection techniques used by adversaries for defense evasion or privilege escalation. The rule includes filters to reduce false positives from known legitimate remote thread creations by some of these processes.
The analytic detects the creation of a remote thread in the Local Security Authority Subsystem Service (LSASS) process, identified using Sysmon EventID 8 logs. This activity is a strong indicator of credential dumping, a tactic used by adversaries to steal user authentication credentials. Successful exploitation could lead to unauthorized access to sensitive information and potential network compromise. Analysts should investigate to distinguish between legitimate tools and malicious activity.
Detects a sequence of events indicative of Process Doppelgänging, a technique used by APT37. This rule identifies a process creating a legitimate Windows utility and then immediately injecting code into it, which is characteristic of creating a process in a suspended state for injection.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
Detects process injection into ImagingDevices.exe, a technique observed in the 'Illusory Wishes' campaign to evade detection. The threat actor used trojanized versions of Element and VLC to inject shellcode into this legitimate Windows process.
Detects uncommon processes creating remote threads. This rule specifically looks for remote thread creation events where the source image is one of a predefined list of common Windows executables (explorer.exe, iexplore.exe, msiexec.exe, powerpnt.exe, schtasks.exe, winlogon.exe) and filters out known legitimate behaviors for these processes to reduce false positives. This activity can be indicative of process injection techniques used by malware or adversaries.
Detects remote thread creation in uncommon target processes such as 'calc.exe', 'notepad.exe', 'mspaint.exe', 'ping.exe', 'sethc.exe', 'spoolsv.exe', 'wordpad.exe', and 'write.exe'. This activity can indicate process injection techniques used for defense evasion or privilege escalation.
Detects uncommon processes creating remote threads.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE".
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects uncommon processes creating remote threads.
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
Detects remote thread creation from CACTUSTORCH as described in references.
Offensive tradecraft is switching away from using APIs like "CreateRemoteThread", however, this is still largely observed in the wild.
This rule aims to detect suspicious processes (those we would not expect to behave in this way like winword.exe or outlook.exe) creating remote threads on other processes.
It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.
This rule aims to detect suspicious processes (those we would not expect to behave in this way like winword.exe or outlook.exe) creating remote threads on other processes.
It is a generalistic rule, but it should have a low FP ratio due to the selected range of processes.
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
Detects remote thread injection events based on action seen used by bumblebee
Detects a remote thread creation of Ttdinject.exe used as proxy
Page 19 of 21