Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects instances where a process obtains a handle with PROCESS_VM_WRITE access to another process, followed shortly thereafter by a WriteProcessMemory operation into that same target process. This behavior is indicative of potential process injection, such as hooking remote GUI processes or other memory-based manipulation techniques.
Detects the Chromelevator loader, identified as 'drun.exe', performing reflective DLL injection of 'payload.dll' using direct syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) and inter-process communication (IPC) via a named pipe ('__DLL_PIPE_COMPLETION_SIGNAL__'). The rule looks for process creation, remote thread creation, memory protection modifications, file creation/modification of 'payload.dll', and specific named pipe events associated with 'drun.exe'.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects when common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) load a DLL file from suspicious or user-writable locations such as AppData, Downloads, Documents, or Temp folders. The rule specifically alerts on DLLs that are unsigned or where the loading process itself is unsigned, which is a common indicator of side-loading or malicious library injection.
Detects instances where common Windows system processes (dllhost.exe, mmc.exe, svchost.exe) spawn known living-off-the-land binaries (LotLBin) or command-line interpreters. This behavior is often indicative of process injection or malicious activity where an adversary leverages trusted system processes to execute commands or malicious scripts.
Detects the creation of named pipes with names commonly utilized by offensive C2 frameworks such as Cobalt Strike, Metasploit, and Covenant. By monitoring for specific pipe naming patterns created by non-system processes, this rule aims to identify potential post-exploitation activity, C2 beacons, or lateral movement tools.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects the use of known named pipes associated with Cobalt Strike post-exploitation frameworks, often used for inter-process communication during beaconing or lateral movement.
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
Detects APC injection technique using QueueUserAPC for code execution
Detects malware resolving API calls dynamically to evade static analysis
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
This rule detects cross-process memory allocation, memory writing, and thread creation activities targeting critical Windows processes like svchost.exe or explorer.exe. Such actions are commonly utilized by attackers for code injection (e.g., Payouts King tradecraft) to execute arbitrary code within the context of trusted processes, enabling evasion or persistence.
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Infostealer distributed via fake open-source tool impersonation sites
Photo-themed ZIP phishing campaign dropping a Node.js implant
Infostealer-as-a-service targeting browser credentials and crypto wallets
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Latin American banking trojan using DLL side-loading and overlay attacks
Campaign converting compromised FortiGate firewalls into credential stealers
Page 28 of 55