Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
The following analytic detects suspicious remote thread execution in processes such as Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware like Qakbot. This detection leverages Sysmon EventCode 8 to identify remote thread creation in specific target processes. This activity is significant as it often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution. If confirmed malicious, this could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence on the compromised host.
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects autoit3.exe invoking process injection Windows APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle) from kernel32.dll targeting the legitimate charmap.exe process, consistent with the AutoIT payload injector chain delivering VIPKeylogger/MedusaHVNC.
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects unauthorized process injection attempts—such as remote thread creation, memory writes, or OpenProcess calls—targeting browser processes (chrome.exe, firefox.exe). The rule filters out known-legitimate security tools and browser helper processes by leveraging process names, company metadata, and valid digital signatures. This activity is indicative of credential or crypto wallet theft, as seen in stealers like Dolphin X.
Detects cross-process memory operations and CreateRemoteThread calls targeting explorer.exe or svchost.exe from non-standard (untrusted) process paths. This activity is consistent with StealC infostealer unpacking and injection behavior, typically following initial execution by SmartLoader as seen in recent FakeGit/AgentBaiting campaigns.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Detects process injection where itcsrvup64.exe (the ViPNet Update System component, sideloaded per HelloNet campaign) creates a remote thread in svchost.exe using NtWriteVirtualMemory/NtCreateThreadEx, targeting the netsvcs service host process.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
Detects remote thread creation from CACTUSTORCH as described in references.
Detects an infostealer-style remote injection chain where a non-browser process allocates memory, writes a DLL path, and creates a remote thread pointing at kernel32!LoadLibraryW inside chrome.exe, msedge.exe, brave.exe, or firefox.exe. This suspend-inject-resume pattern is used by WEES Stealer to load its payload DLL into a browser process before intercepting App-Bound key material.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Page 9 of 21