Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects a suspicious pattern associated with the SLEEPWALKER technique, involving multiple memory write operations followed by a memory protection change within an ERAAgent.exe process. This behavior suggests code injection or dynamic code loading within a process.
Detects a suspicious process injection chain (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) targeting the Windows Character Map utility (charmap.exe) located within the SysWOW64 directory. This activity is often used by adversaries to execute malicious code within a legitimate, signed process context to evade security monitoring.
Detects the reflective or in-memory loading of the AsyncRAT DLL (Veukuzmw.dll) into the memory space of the legitimate Windows process charmap.exe, characterized by a lack of corresponding disk activity or suspicious process command-line arguments.
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
This rule detects potentially malicious activity where a critical system library like 'kernelbase.dll' is loaded into a Chrome process, followed by events indicative of reflective DLL injection or memory-based code loading. Such behavior is often associated with browser-based exploitation, where an attacker attempts to inject malicious code into the legitimate Chrome process space to maintain persistence or conduct further malicious activities.
Detects suspicious process injection attempts originating from or targeting the Google Chrome browser (chrome.exe). The rule identifies cross-process activities such as remote thread creation or opening processes with high-privilege access masks (0x1FFFFF), which are common techniques used by malware to execute code within the memory space of a legitimate web browser.
This rule detects a correlation between the creation of a specific suspicious file named 'A08744D2.tmp' and the subsequent activity of the Windows Media Player Network Sharing Service ('wmpnetwk.exe') within a short time window. This pattern often indicates potentially malicious activity where a temporary file may be used to stage or interact with the service process.
Detects the legitimate wmpnetwk.exe process, commonly used as a target for ShadowPad process injection, initiating outbound network connections while simultaneously accessing Firefox browser profile data. This behavior is indicative of credential theft and command-and-control communication typical of post-compromise activity.
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects artifacts of the winAgent v2.0 Windows implant line, including mod_* modules, WUEngine persistence binaries, and COM/CLSID hijack strings used by AI-assisted implant development
Detects the GoCaracal lightweight implant performing process injection by identifying combinations of remote process memory allocation (VirtualAllocRemoteApiCall), memory writing (WriteProcessMemoryRemoteApiCall), and remote thread creation (CreateRemoteThreadApiCall) associated with specific suspicious filenames. It also monitors command-line activity for injection-related flags.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
Detects potential credential harvesting or process memory manipulation against browser processes (Chrome or Edge). The rule monitors for unauthorized debugging activity initiated against browser processes (e.g., using flags like DEBUG_PROCESS or specific API calls) and the access of the App-Bound encryption provider symbol, which is often a target for attackers seeking to decrypt browser-stored secrets.
This rule detects potential process injection or evasion attempts by correlating the allocation of memory with Read-Write-Execute (RWX) permissions followed by the execution of Windows Thread Pool APIs (CreateThreadpoolWork, SubmitThreadpoolWork, or WaitForThreadpoolWorkCallbacks). Attackers may use these APIs as a mechanism to execute malicious code within a thread, bypassing standard monitoring of traditional thread creation APIs.
Detects the suspicious registration of a Cloud Filter provider callback using staging paths and naming conventions associated with the ShieldCrash (CVE-2026-69414) exploit. The rule monitors DeviceEvents for cloud provider activity that originates from unsigned or untrusted binaries, excluding known-legitimate cloud synchronization clients.
Detects a discrepancy between the SHA256 hash of a running process image (via /proc/<pid>/exe on Linux) and the hash of the corresponding binary file on disk. This behavior is indicative of process memory manipulation, such as fileless execution or binary replacement, where the code currently running in memory does not match the original file on disk.
Detects potential credential harvesting or process memory manipulation against browser processes (Chrome or Edge). The rule monitors for unauthorized debugging activity initiated against browser processes (e.g., using flags like DEBUG_PROCESS or specific API calls) and the access of the App-Bound encryption provider symbol, which is often a target for attackers seeking to decrypt browser-stored secrets.
Detects a discrepancy between the SHA256 hash of a running process image (via /proc/<pid>/exe on Linux) and the hash of the corresponding binary file on disk. This behavior is indicative of process memory manipulation, such as fileless execution or binary replacement, where the code currently running in memory does not match the original file on disk.
The following analytic detects an unusual process execution pattern where a process running from C:\Windows\SysWOW64\ attempts to execute a binary from C:\Windows\System32\. In a typical Windows environment, 32-bit processes under SysWOW64 should primarily interact with 32-bit binaries within the same directory. However, an execution flow where a 32-bit process spawns a 64-bit binary from System32 can indicate potential process injection, privilege escalation, evasion techniques, or unauthorized execution hijacking.
This rule monitors for indicators of compromise (IOCs) and behavioral patterns associated with the Lazarus Group's 'Operation Dream Job' campaign. It tracks known malicious hashes, domains, and IP addresses, alongside suspicious activities such as PDF viewer abuse, DLL side-loading, process injection, persistence mechanism creation (Registry/Scheduled Tasks), and recruitment-themed phishing lures.
Page 16 of 55