Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects suspicious processes attempting to open security-critical DLLs like amsi.dll or ntdll.dll with potential write or execute access. This behavior is often associated with runtime patching techniques used to disable or evade AMSI (Antimalware Scan Interface) and ETW (Event Tracing for Windows) monitoring, which are common defensive evasion tactics.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects execution of the MovieReaper initial loader binary. This malware employs advanced anti-analysis techniques, specifically manual PEB-walking to resolve APIs and evade detection by standard library loading hooks. The rule alerts on known file hashes and specific masquerading filenames.
Detects execution of the MovieReaper initial loader binary. This malware employs advanced anti-analysis techniques, specifically manual PEB-walking to resolve APIs and evade detection by standard library loading hooks. The rule alerts on known file hashes and specific masquerading filenames.
Detects evidence of the MovieReaper loader technique. This behavior involves registering or rewriting Vectored Exception Handlers, allocating memory with EXECUTE_READWRITE protection, and triggering debug-break exceptions to redirect execution into raw NtProtectVirtualMemory syscalls, effectively bypassing user-mode API hooks often used for monitoring.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects suspicious execution of ServiceModelReg.exe, either by referencing a specific known malicious file path ('purosangue.tx') or when launched by an unexpected parent process. This activity is indicative of potential COM elevation moniker abuse or process hollowing techniques often used in post-exploitation scenarios.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
Detects the loading of amsi.dll or clr.dll into the charmap.exe process. Adversaries often inject malicious code into legitimate, system-native processes like charmap.exe to bypass detection and perform in-memory patching of security controls, such as disabling AMSI (Antimalware Scan Interface).
Detects outbound network connections initiated by charmap.exe, a standard Windows utility that does not naturally communicate over the network. This activity is highly indicative of process injection or malicious code masquerading as a system utility to facilitate credential theft or command and control communication.
Detects the loading of known SparroWocky loader DLLs (winfsp-x64.dll or DukeQt.dll) into a process, followed by the absence of new executable file creation within the same process and time window. This behavior is indicative of in-memory execution techniques, such as Beacon Object File (BOF) loading, aimed at extending implant functionality without writing files to disk.
Detects anomalous thread execution call stacks indicative of the SparroWocky anti-forensic evasion technique. This method involves spoofing thread start addresses and call stacks by injecting or manually manipulating stack frames to include legitimate-looking system functions (e.g., BaseFlushAppcompatCacheWorker, BaseCheckVDMp) alongside malicious execution patterns involving NtDelayExecution and SleepEx to hide the true origin of code execution.
Detects remote thread creation attempts (via CreateRemoteThread or NtCreateThreadEx) where the associated module path is empty or null, which is a common indicator of process injection techniques attempting to execute code without a backing file on disk.
Detects the execution of an executable file where the command line matches a specific pattern of a single character argument (e.g., '.exe s'). This behavior is frequently associated with malicious tools attempting to perform actions with minimal command-line footprints or potential process injection/tampering patterns when executed by a different user than the initiating process.
Detects threads created using CreateThread or CreateRemoteThread where the start address resolves to the AnimateWindow function in user32.dll. This technique is often used by malware, such as those leveraging the MinHook library, to disguise the true entry point of injected code by redirecting thread execution through a legitimate Windows API function (hooking).
Detects the allocation of executable memory regions (RWX or EXECUTE_READ) that are not backed by a file on disk (i.e., anonymous memory). This behavior is a common indicator of process injection, shellcode execution, or fileless malware techniques where code is injected into a process and executed directly from memory without a corresponding file on disk.
Detects in-memory execution and stack-spoofing activities associated with the SparroWocky BOF loader (RunCOFF). It monitors for suspicious remote thread creation (EventCode 8), process access with highly permissive access masks (EventCode 10), and the loading of specific suspect DLLs (EventCode 7) that are indicative of this technique.
Detects the suspicious registration of a Cloud Filter provider callback using staging paths and naming conventions associated with the ShieldCrash (CVE-2026-69414) exploit. The rule monitors DeviceEvents for cloud provider activity that originates from unsigned or untrusted binaries, excluding known-legitimate cloud synchronization clients.
Page 12 of 55