Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects process hollowing behavior indicative of the Atlas RAT loader used by TA4922. The rule monitors for the spawning of svchost.exe or notepad.exe by non-standard parent processes located outside legitimate system directories, which is a common indicator of process injection and masquerading techniques.
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
Detects the deployment of the IronWorm eBPF kernel rootkit by monitoring for unauthorized bpf() syscalls, specifically when invoked by suspicious parent processes such as npm or shells. The rule tracks the loading of eBPF programs, the usage of tools like bpftool, tc, and ip, and the presence of specific file artifacts and indicators associated with rootkit behavior like hiding PIDs or network sockets.
macOS malware used by JINX-0164 against cryptocurrency developers
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
This rule correlates a sequence of suspicious activities on a single host within a 24-hour window, indicating a multi-stage intrusion typically associated with ransomware campaigns. The detection chain includes initial credential harvesting (using tools like Impacket, BloodHound, or potential agent drops), followed by defense dismantlement (deleting shadow copies, terminating security processes, and disabling the firewall), and ending with system auditing/recovery sabotage.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects file modification or creation events affecting critical authentication components, specifically Pluggable Authentication Modules (pam_unix.so) and OpenSSH binaries (sshd, ssh, scp). Such activity is highly indicative of an attempt to backdoor the authentication process to facilitate unauthorized access or credential theft, as observed in Operation Highland.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Detects cross-process activity where an unsigned executable residing in common user-writable directories (AppData, Temp, ProgramData) attempts to interact with or inject into sensitive system processes (explorer.exe, svchost.exe, notepad.exe). This behavior is characteristic of malicious process injection attempts.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects unauthorized persistence mechanisms associated with the Miasma MYRA RAT on Linux systems. The rule monitors for the creation of specific hidden files in '/usr/local/lib/' and '/etc/profile.d/', as well as modifications to '/etc/ld.so.preload', while excluding activity from known system package managers.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell processes. The rule looks for known bypass strings, memory patching via Marshal, reflection-based disabling of AmsiUtils, or base64-encoded AMSI patch targets.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Page 39 of 52