Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
Detects suspicious behavior linked to the BeepRAT malware or related tooling (tcc.exe, LuaJit.exe). It monitors for the loading of GDI32 modules by these specific processes and identifies instances where these processes perform cross-process access to sensitive Windows system processes like explorer.exe or dwm.exe, which is indicative of process injection or defense evasion techniques.
Detects cross-process activity (OpenProcess or CreateRemoteThread) targeting critical system processes (svchost.exe, explorer.exe, or rundll32.exe) from suspicious or unexpected parent processes. The rule aggregates multiple events over a short time window to reduce noise and applies a risk-based scoring system based on the injector file location.
Detects anomalous process creation where svchost.exe or explorer.exe is spawned by a process other than standard system parents (e.g., services.exe, wininit.exe). This behavior is consistent with SystemBC (Coroxy) reflective DLL loading or process hollowing, where malicious code is injected into core Windows processes to evade detection.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects artifacts and behavioral patterns associated with the exploitation of the SystemInformer PhSvc (Process Hacker Service) ALPC channel to escalate privileges. The rule monitors for unauthorized rundll32.exe process activity spawning cmd.exe with specific command line arguments, the creation of PoC-related files, and the loading of unsigned modules into the rundll32.exe process.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Detects local privilege escalation attempts targeting AnyDesk by exploiting COM object registration. The attack involves registering a malicious COM server in HKCU to intercept the AnyDesk service's interaction with the print pipe, followed by process token impersonation to gain SYSTEM privileges. The rule monitors for unauthorized COM registration, anomalous process execution from AnyDesk, and cross-process access.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Page 27 of 55