Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.
Detects process argument spoofing techniques to hide true command line from forensics
Detects EWM injection using SetWindowLongPtr API for code execution
This rule detects potential parent PID spoofing attempts by monitoring HTTP traffic for the presence of specific Windows API calls related to process creation and attribute modification. Specifically, it looks for 'UpdateProcThreadAttribute' and 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' in the file data of HTTP responses, indicating that a client might be receiving instructions or code to perform parent PID spoofing.
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
Detects parent process ID spoofing used to hide malicious process relationships
Detects a Windows Filtering Platform (WFP) blocked connection event involving common Endpoint Detection and Response (EDR) agents.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Adversaries may use WFP filters to prevent Endpoint Detection and Response (EDR) agents from reporting security events.
Detects blocked attempts to change any of Defender's settings such as "Real Time Monitoring" and "Behavior Monitoring"
Potential threat actor tampering with Sysmon manifest and eventually disabling it
Detects the presence of "bpf_probe_write_user" BPF helper-generated warning messages. Which could be a sign of suspicious eBPF activity on the system.
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL
Detects when a memory process image does not match the disk image, indicative of process hollowing.
Detects 'Early Bird' Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes. This technique involves a suspicious parent process (like a script interpreter) creating a suspended 'explorer.exe' process, then injecting malicious code using API calls such as 'QueueUserAPC' and 'WriteProcessMemory' before the process fully starts. This rule specifically looks for the combination of these events within a short timeframe.
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
This detection identifies instances where critical Windows kernel files (ntoskrnl.exe, ntoskml.exe, ntoskrnl64.exe) are executed or manipulated outside of standard system directories (e.g., C:\Windows\System32, C:\Windows\WinSxS). It focuses on processes exhibiting suspicious behaviours such as code injection, driver loading, hooking, or memory mapping/unmapping, while excluding benign system processes like services.exe, trustedinstaller.exe, and dism.exe. It also filters out temporary files created by common browsers (e.g., Chrome, Edge) to reduce false positives. This activity is indicative of potential malicious kernel-level manipulation, such as unauthorised drivers, rootkits, or other advanced persistent threats attempting to bypass security controls.
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
The analytic detects the use of `GetProcAddress` within PowerShell script blocks, captured via PowerShell Script Block Logging (EventCode=4104). The presence of `GetProcAddress` in PowerShell is often indicative of malicious activity, such as process injection or other code execution techniques, as it allows for dynamic resolution of API functions. This behavior is unusual for legitimate PowerShell scripts and suggests an attacker is attempting to execute arbitrary code, potentially leading to system compromise. Analysts should investigate the full script block and any associated processes.
Page 51 of 52