Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects cross-process activity where an unsigned executable residing in common user-writable directories (AppData, Temp, ProgramData) attempts to interact with or inject into sensitive system processes (explorer.exe, svchost.exe, notepad.exe). This behavior is characteristic of malicious process injection attempts.
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects behavior indicative of the Remcos RAT injecting its code into legitimate Windows processes (such as iexplore.exe, ieinstal.exe, ielowutil.exe, svchost.exe, or explorer.exe). The rule identifies this by monitoring for a process matching the Remcos naming convention that launches a secondary process in a suspended state, followed by cross-process activity that deviates from standard system behavior.
Page 30 of 55