Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
Detects uncommon target processes for remote thread creation
Detects remote thread creation by PowerShell processes into "lsass.exe"
Detects the creation of a remote thread from a Powershell process in an uncommon target process
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
Detects the creation of a remote thread from a Powershell process to another process
Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process
Detects the creation of a remote thread in sensitive processes indicative of code injection techniques, such as APC or thread injection.
This analytic identifies suspicious remote thread execution where the `wermgr.exe` process injects code into known browser processes such as `firefox.exe`, `chrome.exe`, `iexplore.exe`, and `microsoftedgecp.exe`. It uses Sysmon EventCode 8 logs to detect this behavior by monitoring the `SourceImage` and `TargetImage` fields. This activity is significant because it is indicative of Qakbot malware, which is known to inject malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
The analytic detects suspicious PowerShell processes attempting to inject code into critical Windows processes using CreateRemoteThread. It leverages Sysmon EventCode 8 to identify instances where PowerShell spawns threads in processes like svchost.exe, csrss.exe, and others. This activity is significant as it is commonly used by malware such as TrickBot and offensive tools like Cobalt Strike to execute malicious payloads, establish reverse shells, or download additional malware. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, and persistent access within the environment.
The following analytic detects suspicious process injection in command shell applications, specifically targeting `cmd.exe` and `powershell.exe`. It leverages Sysmon EventCode 8 to identify the creation of remote threads within these shell processes. This activity is significant because it is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
The analytic detects suspicious remote thread execution in specific processes like Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware. It leverages Sysmon EventCode 8 to identify remote thread creation. This activity often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution, privilege escalation, or persistence on the compromised host.
The analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system.
The analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches.
This analytic detects the creation of a remote thread by rundll32.exe into another process, leveraging Sysmon EventCode 8 logs. This activity is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
Detects remote thread creation in the "mstsc.exe" process by a process located in a potentially suspicious location.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
This technique is often used by attackers in order to hook some APIs used by DLLs loaded by "mstsc.exe" during RDP authentications in order to steal credentials.
This rule detects the creation of a remote thread by a PowerShell process (powershell.exe or pwsh.exe) into specific target processes, namely rundll32.exe or regsvr32.exe. This activity is often indicative of defense evasion and execution techniques used by adversaries to inject malicious code or achieve persistence by leveraging legitimate system binaries.
This rule detects the creation of a remote thread within the KeePass.exe process. This activity is highly suspicious as it can indicate an attacker attempting to inject malicious code into KeePass to extract sensitive information, such as master passwords or stored credentials. This technique is commonly used by tools like KeeFarce and KeeThief for password dumping from KeePass.
Detects the creation of a remote thread by 'Ttdinject.exe', which can be abused as a proxy to execute malicious code. This technique is often used for defense evasion.
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Page 20 of 21