Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This detection catches activity of PowerShell injecting into a remote process. In the source article and ClickFix attack chain analysis, the targeted processes observed were svchost.exe and explorer.exe. However upon testing, a baseline was established to show that PowerShell should not be observed injecting into any other process besides itself via the ActionType of CreateRemoteThreadApiCall.
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects creation of or connection to the \\.\Pipe\ChromeUpdatePipe named pipe used by CRAT's co-installed injector module to deliver payloads for process injection into a legitimate process.
Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects unauthorized process injection attempts—such as remote thread creation, memory writes, or OpenProcess calls—targeting browser processes (chrome.exe, firefox.exe). The rule filters out known-legitimate security tools and browser helper processes by leveraging process names, company metadata, and valid digital signatures. This activity is indicative of credential or crypto wallet theft, as seen in stealers like Dolphin X.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Generic rule content from file: TOKYOCORE Winlogon Hijack: Userinit/Shell, Notify DLL, Forced Auto-Logon
Detects coordinated EDR-blinding techniques where a process performs in-memory patching of AMSI (AmsiScanBuffer) or ETW (EtwEventWrite) while simultaneously executing direct syscalls to bypass standard ntdll.dll hooked exports. This combination is highly indicative of malicious activity attempting to evade endpoint security instrumentation.
Detects cross-process memory operations and CreateRemoteThread calls targeting explorer.exe or svchost.exe from non-standard (untrusted) process paths. This activity is consistent with StealC infostealer unpacking and injection behavior, typically following initial execution by SmartLoader as seen in recent FakeGit/AgentBaiting campaigns.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Page 20 of 55