Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Detects potential Anti-Malware Scan Interface (AMSI) bypass attempts by identifying processes modifying the AmsiOpenSession function within amsi.dll memory using VirtualProtect, a technique observed in the DcRAT malware.
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, a known evasion tactic to blind EDR telemetry before full execution. This rule specifically looks for WriteProcessMemory API calls targeting memory regions near the base address of ntdll.dll, initiated by processes like InstallUtil.exe, MSBuild.exe, or powershell.exe.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
Detects the Komari agent spawning svchost.exe in a suspended state (no arguments) and writing memory into it to hide malicious execution. The rule identifies svchost.exe processes launched without the '-k' argument (indicating a suspended state) and then correlates these launches with subsequent 'WriteProcessMemoryApiCall' events targeting the same process within a one-minute window.
Detects process hollowing technique for code injection
Detects Kazuar executing process hollowing into legitimate Windows binaries like taskhostw.exe to blend in with normal OS behavior. This rule specifically looks for instances where 'taskhostw.exe' is the target process but its command line does not contain 'taskhostw.exe', indicating a potential suspended or hollowed launch, combined with network activity originating from that process.
Correlates a Valid-signed executable starting a legitimate Windows binary (e.g., svchost.exe) in a suspended state for memory injection.
Detects process hollowing technique for code injection
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
Detects local memory allocations changing state to PAGE_EXECUTE_READWRITE inside Go-compiled executables to execute shellcode. This behavior is indicative of reflective code loading, often used by malware to evade detection.
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
Detects PE injection technique using NtUnmapViewOfSection
Detects thread hijacking using SuspendThread and SetThreadContext
Detects thread hijacking using SuspendThread and SetThreadContext
Page 50 of 52