Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects process injection where itcsrvup64.exe (the ViPNet Update System component, sideloaded per HelloNet campaign) creates a remote thread in svchost.exe using NtWriteVirtualMemory/NtCreateThreadEx, targeting the netsvcs service host process.
Detects the creation of a remote thread that initiates execution from memory that is not backed by a known file module on disk. This is a common indicator of process injection techniques, such as reflective DLL injection or shellcode execution, where the payload exists only in memory.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
Detects the loading of 'abe_decrypt.dll' into Google Chrome or Microsoft Edge browser processes. This behavior is highly irregular and often associated with browser-based malware, credential theft, or injection attempts to intercept browser data.
Detects SHARDLOADER/ZOHOMURK/MINIRECON related loader DLL via embedded mutex name, XOR key, staging file paths, and exported function used in Mustang Panda campaigns
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
This rule detects the creation of or connection to the hardcoded 'RoguePlanet' named pipe, which is utilized as an IPC synchronization channel by the Nightmare Eclipse Defender exploit. The rule monitors for both pipe creation and connection events via Sysmon and Defender for Endpoint (DeviceEvents) telemetry, flagging potential malicious usage or interactions with security processes.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
This rule detects potentially malicious activity involving the ServiceModelReg.exe process, a known vector for ResiLoader process hollowing. It monitors for cross-process injection (e.g., process hollowing) and process creation events where ServiceModelReg.exe is spawned by suspicious parent processes (such as scripting engines) or originates from an unexpected location.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
This rule detects processes that perform both memory allocation (VirtualAlloc) and cryptographic random number generation (BCryptGenRandom) within a short timeframe. This combination is highly characteristic of reflective loading or stage-based process injection, where an adversary allocates memory for shellcode and generates keys or seeds for encrypted payloads, often used to evade signature-based detection.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Detects the creation of the named pipe '\pipe\RoguePlanet', which is specifically utilized by the RoguePlanet CVE-2026-50656 exploit. The exploit uses this pipe for synchronization during a TOCTOU race condition against MsMpEng.exe. Once the race is won, a SYSTEM-level payload (typically masquerading as a child process of wermgr.exe) uses this pipe to verify the originating session and subsequently spawn an interactive shell as NT AUTHORITY\SYSTEM. This pipe name is unique to this exploit and not used by legitimate software.
Detects the execution of known command-line artifacts and tools associated with direct and indirect system call resolution, such as SysWhispers, HellsGate, and HellHall. These techniques are commonly employed by adversaries to bypass user-mode EDR hooks by invoking NT syscalls directly.
This rule detects potential malicious process injection originating from web browsers (chrome.exe or msedge.exe) when followed by the creation or access of a hex-named text file in the C:\ProgramData directory within a 5-minute window. This behavior often suggests a staged attack where a browser process is used to inject malicious code, and subsequently reads or interacts with a dropped file used for persistence or command-and-control communication.
Detects instances of CreateRemoteThread API calls targeting sensitive host processes (svchost.exe, explorer.exe, lsass.exe, etc.) where the source process is not a recognized system component. This behavior is indicative of reflective DLL injection, a technique often used to execute code within the address space of a remote process to bypass security controls or user-mode hooks.
Detects indicators of activity associated with 'RoguePlanet', including specific command-line strings, named pipes, process spawning behaviors related to Microsoft Defender (MsMpEng.exe), and suspicious staging patterns involving 'wermgr.exe' in temporary directories.
Detects process hollowing behavior where a ClickFix-delivered loader payload targets legitimate Windows host processes like explorer.exe or svchost.exe. The detection looks for a combination of memory operations (NtUnmapViewOfSection, WriteProcessMemory, PAGE_EXECUTE_READWRITE allocation) and thread control (SetThreadContext, ResumeThread) indicative of malicious code injection.
Page 22 of 55