Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects unauthorized attempts to place an exclusive byte-range lock on the wermgr.exe executable when accessed via Volume Shadow Copy (VSS) or temporary paths, which is characteristic of the RoguePlanet exploit. This technique is designed to stall Windows Defender's clean-up operations, creating a time-of-check to time-of-use (TOCTOU) race window for further exploitation.
Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.
Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.
Detects unauthorized attempts to terminate security-related processes using direct syscalls (ZwTerminateProcess). The rule monitors for processes attempting to access AV/EDR security products with high-level access rights (0x0001 or 0x1fffff) while excluding authorized security processes themselves.
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
Detects unauthorized modification of file flags on core system binaries (e.g., /bin, /sbin, /usr/bin) followed by write/modification operations. This behavior is indicative of an attacker attempting to bypass immutable flags to modify or replace critical system files, often seen in rootkits or malware to achieve persistence or tamper with system integrity.
Detects cross-process memory write activity characteristic of the SPECTRALVIPER reflective injection technique. The rule identifies specific carrier processes (such as IntelAudioService.exe or OneDrive.Sync.Services.exe) that are either unsigned or spawned by a suspicious parent process, performing memory operations on other processes.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects evidence of the SPECTRALVIPER backdoor, specifically targeting its token theft and impersonation capabilities ('XGU::Feature'). The rule monitors for presence of specific internal RTTI class names and method strings in process command lines or activity associated with specific potentially compromised host processes such as OneDrive or Intel Audio services.
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
Page 44 of 52