Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This rule detects the process 'charmap.exe' establishing an outbound network connection to a known AsyncRAT command-and-control (C2) IP address and port. This behavior is indicative of process injection where the legitimate Windows Character Map utility is utilized as a host process for malicious AsyncRAT payload execution.
This rule monitors for suspicious memory-based code execution patterns, such as reflective loading or execution of code from memory segments marked with executable permissions (PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_READ) that do not originate from a signed Microsoft file. It specifically flags memory regions containing the MZ header that lack a corresponding backing file, as well as specific known suspicious DLL patterns or memory protection flag changes indicative of process injection or fileless execution.
Detects thread creation where the start address resolves to the 'AnimateWindow' function within 'user32.dll'. This behavior is a known indicator of thread-hijacking techniques, such as those implemented by the SparroWocky framework using the MinHook library, where the thread entry point is spoofed to evade detection.
This rule detects the presence or execution of known malicious DLL files (winfsp-x64.dll or DukeQt.dll) by monitoring process rollups, image loads, and file operations. The detection is triggered by matching the file name against specific SHA1 hashes associated with known malicious activity.
Detects the creation of threads where the entry point or call stack is associated with 'kernel32.dll' but originates from memory regions that are unbacked by a file on disk (i.e., 'unbacked', 'unknown') or have a null return address. This pattern is highly indicative of reflective code injection or manual shellcode execution, where an adversary attempts to execute code within a legitimate Windows process without a corresponding file-backed image.
Detects the loading of specific DLLs ('winfsp-x64.dll' or 'DukeQt.dll') where the module path is empty or null. This behavior is indicative of potential memory-only execution or process injection (e.g., reflective loading), as the module is not associated with a valid file on disk.
This rule detects remote thread creation where the start function address is identified as 'AnimateWindow'. This behavior is associated with the SparroWocky technique, which uses thread execution hijacking by pointing the thread start address to legitimate UI-related Windows APIs to mask the actual malicious entry point, thereby evading traditional detection mechanisms that monitor for suspicious thread start addresses.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
Detects the creation of mutexes or named pipes containing the string 'SALITY', which is a characteristic indicator of the Sality malware family.
Detects the execution of the Windows Character Map utility (charmap.exe) when launched from a user-writable Temp directory by a non-standard parent process. This pattern is commonly associated with malware, such as AsyncRAT, attempting to leverage legitimate system tools to evade detection or facilitate malicious chains.
Detects instances where the Windows Character Map utility (charmap.exe) loads both 'amsi.dll' (Antimalware Scan Interface) and 'clr.dll' (Common Language Runtime). This combination is highly anomalous for charmap.exe and is indicative of process injection or defense evasion attempts, often associated with executing arbitrary malicious code within a trusted system process.
Detects potential process injection attempts involving 'charmap.exe', a Windows system utility. The rule monitors for a sequence of memory management and thread creation API calls (OpenProcess, VirtualAlloc, WriteProcessMemory, and CreateRemoteThread) originating from or targeting this binary, which is often abused as a host for malicious code to bypass security controls.
Detects the suspicious registration of a Cloud Filter provider callback using staging paths and naming conventions associated with the ShieldCrash (CVE-2026-69414) exploit. The rule monitors DeviceEvents for cloud provider activity that originates from unsigned or untrusted binaries, excluding known-legitimate cloud synchronization clients.
This rule detects when common Windows applications (explorer.exe, svchost.exe, winword.exe, excel.exe, rundll32.exe) load DLLs that are either unsigned or located in user-writable directories (e.g., \Users\, \AppData\, \Temp\, \ProgramData\). This is a common indicator of potential DLL hijacking or side-loading attacks.
Detects DLL injection into browser processes (chrome.exe or msedge.exe) followed by the invocation of the browser's Elevation Service 'DecryptData' function, a behavior characteristic of the Rapuncel credential stealer attempting to bypass app-bound encryption.
Detects process injection behavior by monitoring for the usage of specific Windows API functions (NtAllocateVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory, NtWriteVirtualMemory, NtOpenProcess) frequently used by adversaries to execute malicious code within the context of a legitimate process.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
Detects the GoCaracal lightweight implant performing process injection by identifying combinations of remote process memory allocation (VirtualAllocRemoteApiCall), memory writing (WriteProcessMemoryRemoteApiCall), and remote thread creation (CreateRemoteThreadApiCall) associated with specific suspicious filenames. It also monitors command-line activity for injection-related flags.
Page 14 of 55