Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects suspicious inter-process communication via named pipes and cross-process thread injection targeting known sideloading host processes, specifically associated with the SPECTRALVIPER threat activity.
Detects successful authentication for a user account immediately following a password change event. This pattern is indicative of a compromised PAM (Pluggable Authentication Modules) component or similar authentication backdoor that utilizes a hardcoded 'master' password to maintain access, bypassing credential rotation. This behavior is associated with the threat actor Velvet Ant (Operation Highland).
Detects anomalous thread context manipulation events, specifically those involving multiple SetThreadContext API calls within a short period, consistent with Gargoyle-style ROP/NtContinue sleep obfuscation techniques. This method cycles memory protections during C2 beacon sleep intervals to evade point-in-time memory scanners by keeping executable memory hidden.
Detects memory protection modification patterns indicative of the Ekko sleep obfuscation technique. Ekko cyclically transitions memory regions containing beacon code between PAGE_EXECUTE_READ and PAGE_READWRITE states using timer queue callbacks to evade memory scanning tools. The detection identifies rapid, repeating, bidirectional memory protection changes on private memory regions within a 600ms window.
Detects reflective PE loading behavior potentially associated with the GIFTEDCROOK malware family. The rule monitors PowerShell processes that interact with the Windows API NtProtectVirtualMemory to set memory pages to PAGE_EXECUTE_READWRITE (0x40), a common technique for staging and executing shellcode in process memory.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell 7 by leveraging the JIT heap to patch internal AmsiUtils methods or manipulate System.Management.Automation AMSI fields.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects instances where a process obtains a handle with PROCESS_VM_WRITE access to another process, followed shortly thereafter by a WriteProcessMemory operation into that same target process. This behavior is indicative of potential process injection, such as hooking remote GUI processes or other memory-based manipulation techniques.
This rule detects potential process injection attempts targeting the Windows Update Service (wusvc.exe). It monitors for suspicious API calls, including VirtualAlloc, VirtualProtect, WriteProcessMemory, and QueueUserAPC, or memory page protections set to PAGE_EXECUTE_READWRITE within the context of the wusvc.exe process. The detection requires multiple distinct indicators of injection to be present, reducing the likelihood of flagging benign administrative activities.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Detects potential Remcos RAT activity utilizing the CMSTPLUA COM interface for UAC bypass. The rule identifies instances where suspicious processes (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed from non-standard locations such as ProgramData, AppData, or Temp folders, which is characteristic of Remcos execution flows.
Detects a signed host process (VirtualAr.exe, NeuroManag.exe) loading a .tmp file as an executable image. This behavior is indicative of a process-hollowing variant where a malicious payload is mapped directly into memory from a cached, non-flushed temporary file, a technique observed in campaigns like Operation Turb00 involving Vidar infostealer.
Detects in-memory DLL injection where a module is loaded into process memory without a backing file path on disk (action_module_path is null or empty). This technique, often referred to as reflective DLL injection, is used to evade detection. The rule further refines detection by flagging cases where the hosting process itself originates from an unusual or user-writable path, which can be indicative of DLL sideloading. This behavior is consistent with malware like Backdoor.Mistic or ModeloRAT, deployed by threat groups such as Woodgnat (KongTuke).
Detects suspicious API call sequences indicative of process injection into the 'svchost.exe' system process. The rule monitors for a combination of memory manipulation and thread execution APIs, such as 'ZwWriteVirtualMemory', 'NtDuplicateObject', 'VirtualAllocEx', and 'CreateRemoteThread', when initiated by processes other than legitimate Windows system processes. This is a common indicator of unauthorized code execution or lateral movement.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for the loading of amsi.dll in suspicious processes, combined with behavioral indicators such as execution from user-writable paths, child process creation, or outbound network connections, and the presence of strings associated with common AMSI bypass techniques.
Detects malicious attempts to impair system defenses on Linux hosts, specifically targeting AppArmor, SELinux, firewalls (UFW/iptables), and security monitoring agents (Crowdstrike/osquery/Aliyun) by the 'lambsys' cryptominer campaign. This behavior aligns with adversary attempts to evade detection and maintain persistence or resource consumption.
This rule detects attempts to disable or interfere with endpoint security products, including Windows Defender and various third-party antivirus agents. It identifies suspicious process executions involving command-line tools like sc.exe, net.exe, or taskkill.exe targeting security services, or the direct modification of Windows registry keys associated with security policy disabling. The detection is further scoped to processes originating from or associated with common suspicious paths (e.g., AppData) or known malicious naming patterns.
Detects multiple indicators of process injection into svchost.exe including suspicious process access rights, remote thread creation, unexpected loading of .NET CLR modules, and the subsequent spawning of suspicious child processes. The rule aggregates these signals to identify potential fileless execution or persistence mechanisms within a legitimate system process.
Page 34 of 52