Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects memory patching operations targeting 'ntdll.dll', specifically aiming to disable ETW (Event Tracing for Windows) by modifying 'EtwEventWrite' or 'NtTraceEvent' functions. This activity is filtered to detect processes originating from PyInstaller-compiled binaries, identified by the use of '_MEI' temporary extraction directories or specific process names like 'winupdate.exe', which are commonly associated with malicious use of the PyInstaller framework.
Detects a suspicious execution chain where a dropper (chrome_setup.exe) uses an AppDomainManager injection technique to load a malicious DLL, followed by the execution of the TinyRCT payload (PerfWatson2.exe) from the LocalAppData directory. This behavior has been observed in campaigns targeting Southeast Asian government and critical infrastructure.
This rule detects suspicious DLL injection activity by identifying multiple DLL loads from unusual folders such as 'Temp', 'AppData', or 'Windows\Temp'. Adversaries often drop malicious DLLs into these directories and then inject them into legitimate processes to achieve persistence, privilege escalation, or defense evasion. The rule counts the number of DLL loads from these suspicious locations by the same initiating process on the same device, triggering an alert if five or more such loads occur, indicating a concerted malicious effort.
Detects the execution of Microsoft Application Virtualization Injector (mavinject.exe) with the '/injectrunning' command-line argument. This utility is frequently abused by adversaries to inject malicious DLLs into target processes, facilitating arbitrary code execution while potentially bypassing security detections due to the binary's legitimate provenance.
Detects suspicious inter-process communication via named pipes and cross-process thread injection targeting known sideloading host processes, specifically associated with the SPECTRALVIPER threat activity.
Detects the creation of suspicious file types (.exe, .dll, .ps1, etc.) in common staging directories (e.g., C:\Users\Public, C:\Windows\Temp) by the DllHost.exe process. The rule filters out known-good COM surrogate CLSIDs but flags instances where DllHost.exe is launched without a /Processid argument (potential WSL2 proxy activity) or with an unrecognized CLSID, suggesting potential COM hijacking or file staging.
Detects anomalous thread context manipulation events, specifically those involving multiple SetThreadContext API calls within a short period, consistent with Gargoyle-style ROP/NtContinue sleep obfuscation techniques. This method cycles memory protections during C2 beacon sleep intervals to evade point-in-time memory scanners by keeping executable memory hidden.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects instances where a process obtains a handle with PROCESS_VM_WRITE access to another process, followed shortly thereafter by a WriteProcessMemory operation into that same target process. This behavior is indicative of potential process injection, such as hooking remote GUI processes or other memory-based manipulation techniques.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Detects process creation events where the Image field lacks an absolute path,
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
Detects Remcos RAT-related User Account Control (UAC) bypass activity. The rule identifies suspicious process creation and cross-process patterns where non-Microsoft signed executables, specifically those often masquerading as explorer.exe or interacting with system-level binaries (e.g., iexplore.exe, svchost.exe, fsutil.exe), attempt to elevate privileges using COM interfaces such as CMSTPLUA.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects suspicious DLL injection activity by identifying multiple DLL loads from unusual folders such as 'Temp', 'AppData', or 'Windows\Temp'. Adversaries often drop malicious DLLs into these directories and then inject them into legitimate processes to achieve persistence, privilege escalation, or defense evasion. The rule counts the number of DLL loads from these suspicious locations by the same initiating process on the same device, triggering an alert if five or more such loads occur, indicating a concerted malicious effort.
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
Detects injection of malicious DYLIB libraries via LC_LOAD_DYLIB mechanism
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects a non-browser process creating a remote thread with a LoadLibraryW start function targeting chrome.exe, msedge.exe, or brave.exe, which is indicative of a suspend-inject-resume technique used to load unauthorized DLLs into a browser process, potentially bypassing browser protections such as App-Bound Encryption.
Detects in-memory DLL injection where a module is loaded into process memory without a backing file path on disk (action_module_path is null or empty). This technique, often referred to as reflective DLL injection, is used to evade detection. The rule further refines detection by flagging cases where the hosting process itself originates from an unusual or user-writable path, which can be indicative of DLL sideloading. This behavior is consistent with malware like Backdoor.Mistic or ModeloRAT, deployed by threat groups such as Woodgnat (KongTuke).
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Page 25 of 55