Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
This rule detects suspicious process injection activity directed at Chrome or Edge browser processes, followed immediately by file access to sensitive browser data files like 'Login Data' or 'Cookies'. This pattern is indicative of an adversary attempting to steal credentials or session cookies from a user's web browser memory and disk storage.
Detects PowerShell instances performing suspicious memory operations like thread injection (e.g., VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) targeting common processes such as csc.exe, browser processes (chrome.exe, msedge.exe), and system processes like SearchIndexer.exe. This activity is indicative of malicious code injection often used in stealth execution and credential harvesting campaigns.
Detects PowerShell attempts to perform remote process injection into potentially suspicious or sensitive processes (csc.exe, chrome.exe, msedge.exe, SearchIndexer.exe) by searching for command line arguments indicating the usage of Windows memory allocation or thread context manipulation APIs such as NtAllocateVirtualMemoryRemote and NtSetContextThreadRemote.
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects evidence of ONYXC2 malware activity by correlating process-related events (mutex creation, remote thread injection, named pipes) with suspicious registry key or value modifications containing the 'ONYXC2' indicator within a 5-minute window.
Detects the use of the undocumented NTAPI function EtwpCreateEtwThread within a thread creation call trace. This function is often abused by shellcode loaders to execute malicious code within a target process while attempting to evade standard EDR detection mechanisms.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects execution artifacts of the MovieReaper stage 2 implant, specifically its capability to parse and load COFF modules into memory without writing them to disk. The rule monitors process command lines for 'module_init' and identifies suspicious API activity related to memory-based module loading, such as reflective DLL loading or remote thread creation.
Detects execution artifacts of the MovieReaper stage 2 implant, specifically its capability to parse and load COFF modules into memory without writing them to disk. The rule monitors process command lines for 'module_init' and identifies suspicious API activity related to memory-based module loading, such as reflective DLL loading or remote thread creation.
Detects remote thread creation attempts (via CreateRemoteThread or NtCreateThreadEx) where the associated module path is empty or null, which is a common indicator of process injection techniques attempting to execute code without a backing file on disk.
Detects threads created using CreateThread or CreateRemoteThread where the start address resolves to the AnimateWindow function in user32.dll. This technique is often used by malware, such as those leveraging the MinHook library, to disguise the true entry point of injected code by redirecting thread execution through a legitimate Windows API function (hooking).
Detects a suspicious multi-step process injection sequence originating from an obfuscated PowerShell process. The rule identifies PowerShell executing with common obfuscation flags (e.g., -enc, -nop, IEX) and performing multiple API calls (such as NtAllocateVirtualMemoryRemote, NtSetContextThreadRemote, CreateRemoteThread, or OpenProcess) targeting specific executables like csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Detects a suspicious PowerShell process lineage spawned by explorer.exe that exhibits characteristics of a 'ClickFix' social engineering lure (using obfuscated command lines) and proceeds to inject code into legitimate Windows or browser processes such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with malware attempting to evade debugging.
Page 5 of 21