Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
This analytic detects process injection into commonly abused Windows executables using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40, 0x1fffff, or 0x1f3fff) to processes such as notepad.exe, wordpad.exe, calc.exe, mspaint.exe, lsass.exe, svchost.exe, and web browsers, while excluding injections originating from common system paths like System32 and Program Files. This behavior is often associated with the SliverC2 framework. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code, potentially leading to privilege escalation or persistent access.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
Detects potential_APT-style process hollowing on Linux using syscall stubs and string camouflage
Detects when a memory process image does not match the disk image, indicative of process hollowing.
ShimCache Flush
YARA-L
Detects actions that clear the local ShimCache and remove forensic evidence
Dopplepaymer In-Memory Malware Implant.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
This query identifies processes with command line launch strings.
Which match the pattern used in Dopplepaymer ransomware attacks.
Detects when a memory process image does not match the disk image, indicative of process hollowing. This rule specifically looks for 'Image is replaced' events and filters out common legitimate applications that might exhibit similar behavior, such as applications in 'Program Files', 'Windows\System32\wbem\WMIADAP.exe', 'Windows\SysWOW64\wbem\WMIADAP.exe', Opera, and Edge.
Detects suspicious WMI event filter and command line event consumer based on WMI and Security Logs.
Page 52 of 52