Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects signs of process hollowing targeting ServiceModelReg.exe, a technique used by ResiLoader to execute the StealC information stealer. The rule monitors for suspicious cross-process access (high-privilege handles), remote thread creation, and anomalous module loading patterns within the target process.
Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.
Detects potential privilege escalation attempts targeting AnyDesk runtime via named pipe exploitation. The rule monitors for unauthorized cross-process access to AnyDesk processes, AnyDesk spawning suspicious child processes indicative of post-exploitation activity, and the execution of a known vulnerable AnyDesk binary version.
Detects anomalous instances of conhost.exe running with SYSTEM integrity within an interactive user logon session. This behavior is indicative of session hijacking techniques, such as those leveraging named pipes or LaunchConsoleInSessionId, used to force console hosts into user-controlled sessions to potentially capture input or manipulate processes.
This rule detects the creation of or connection to a specific named pipe '\RoguePlanet' using Windows Sysmon events 17 (Pipe Created) and 18 (Pipe Connected). It further highlights events where the integrity level of the process interacting with the pipe is 'low' or 'medium', which may indicate potential inter-process communication (IPC) abuse, process injection, or malicious persistence mechanisms often used by attackers to mask execution or communicate between processes.
This rule monitors for indicators of process hollowing or memory injection targeting ServiceModelReg.exe. It correlates suspicious events including the creation of suspended processes, memory writes, remote thread creation, specific debug strings (e.g., RUNPE, PEB patched), and outbound network connections. This approach aims to reduce noise from legitimate use of ServiceModelReg.exe by requiring multiple indicators of malicious behavior.
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
This rule detects the execution of processes named 'RoguePlanet.exe' and monitors for inter-process communication using named pipes with the same name. This pattern is indicative of a specific malware payload attempting to establish communication channels for C2 or process interaction.
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Detects multiple signals associated with potential process injection or hollowing involving 'ServiceModelReg.exe'. The rule correlates process creation in a suspended state, memory injection-related actions, outbound network connections from the process, and specific debug strings often associated with automated process hollowing tools.
Detects suspicious cross-process memory injection activity by correlating remote virtual memory allocation (VirtualAllocEx or MapViewOfSection) followed by the creation of a remote thread (CreateRemoteThread) targeting established legitimate Windows processes. This behavior is commonly associated with malware loaders such as Payouts King and RomulusLoader for facilitating code injection.
Detects cross-process memory injection techniques indicative of the Havoc framework's Demon agent. The rule monitors for Windows API injection sequences (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread/NtCreateThreadEx), reflective image loads into explorer.exe, and Linux /proc/pid/mem direct memory writes used by the agent to persist or execute in-memory.
This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
This rule detects attempts to disable the Antimalware Scan Interface (AMSI) in PowerShell by patching sensitive exported functions (AmsiScanBuffer, AmsiScanString, WinScanContent) within the process memory. Attackers use techniques like VirtualProtect and Marshal.Copy or JIT-compilation via RuntimeHelpers.PrepareMethod to overwrite these functions, effectively forcing AMSI to return an 'AMSI_RESULT_CLEAN' result for all scanned content.
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.
Detects the execution of Microsoft Application Virtualization Injector (mavinject.exe) with the '/injectrunning' command-line argument. This utility is frequently abused by adversaries to inject malicious DLLs into target processes, facilitating arbitrary code execution while potentially bypassing security detections due to the binary's legitimate provenance.
Detects process-related activities involving specific 'XGU::Feature' command line arguments, commonly associated with token manipulation, credential theft, or lateral movement attempts. This rule monitors process creation, cross-process access, and module loading to identify potentially malicious interactions with Windows security tokens.
Page 23 of 55