Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
Detects potential malicious activity including unsigned processes performing cross-process injection into common system processes, suspicious sideloading of 'vulkan-1.dll' from non-standard locations, and execution of unsigned binaries from user-writable directories like Temp, AppData, or ProgramData.
Detects Atlas RAT and ValleyRAT patterns involving process injection into svchost.exe or explorer.exe by an unauthorized process originating from a user-writable directory (e.g., Temp, AppData, Downloads). The rule correlates process injection events with preceding suspicious process launches.
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
macOS malware used by JINX-0164 against cryptocurrency developers
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Page 29 of 55