Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects suspicious activity associated with credential stealers where an unsigned or unrecognized process accesses MetaMask or Exodus wallet vault/seed files, performs process injection into legitimate browser/wallet binaries, or attempts to utilize DPAPI (CryptUnprotectData) or PBKDF2 for wallet credential decryption.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Detects the loading of amsi.dll by rundll32.exe when invoked with specific command-line arguments. This pattern is associated with the TELEPUZ malware, which leverages this technique to patch the AmsiScanBuffer function in memory, effectively disabling AMSI (Antimalware Scan Interface) scanning for the process.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects instances where rundll32.exe, likely used by the TELEPUZ threat actor, performs a direct file read of ntdll.dll from standard Windows system directories. This behavior is indicative of an attempt to obtain an unhooked copy of ntdll.dll to overwrite the in-memory, hooked version, thereby evading security monitoring.
Detects the loading of a potentially malicious DLL (WinUpdateHelper.dll) by a process masquerading as or identified as a GTA 5 Online mod menu. This behavior is indicative of DLL injection or side-loading techniques used by gaming cheats/malware to maintain execution context.
Detects the use of the 'EnumSystemLocalesA' API call where the provided callback address points to a non-image backed memory region with 'EXECUTE' permissions. This pattern is indicative of process injection techniques, where an adversary uses an API callback mechanism to execute malicious code within the memory space of a legitimate process.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Page 21 of 55