Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
This rule detects suspicious inter-process communication (IPC) attempts using WM_COPYDATA messaging, where processes (often script interpreters or unsigned binaries) interact with high-value GUI-based applications (like browsers or shell environments). This pattern is a common indicator of process injection techniques, such as hijacking existing Windows callbacks to execute code within the context of a target process.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects the W2 Malvertising loader waiting for the EDR to be killed before performing cross-process injection (Process Hollowing) into a new legitimate binary. This rule correlates the loading of a new, non-Windows driver with subsequent process memory injection within a 5-minute window, indicating potential BYOVD (Bring Your Own Vulnerable Driver) attacks followed by in-memory malware execution.
This rule detects cross-process operations (such as memory access or thread injection) initiated by processes that are not signed by known, trusted vendors, or that do not reside in protected system directories. This behavior is a common indicator of process injection techniques used to evade security controls.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Detects cross-process activity where an unsigned executable residing in common user-writable directories (AppData, Temp, ProgramData) attempts to interact with or inject into sensitive system processes (explorer.exe, svchost.exe, notepad.exe). This behavior is characteristic of malicious process injection attempts.
Detects the creation of named pipes with names commonly utilized by offensive C2 frameworks such as Cobalt Strike, Metasploit, and Covenant. By monitoring for specific pipe naming patterns created by non-system processes, this rule aims to identify potential post-exploitation activity, C2 beacons, or lateral movement tools.
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
This rule detects attempts to inject malicious DLLs into common Windows processes such as svchost.exe, explorer.exe, lsass.exe, and winlogon.exe. The detection is based on the loading of DLLs with suspicious names like 'hook.dll', 'inject.dll', 'payload.dll', or 'stage.dll' by these processes, which is indicative of process injection techniques often used by malware like Remcos RAT.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects suspicious process injection attempts where common scripting/execution binaries (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are observed creating remote threads in other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe). The detection is further refined by looking for specific keywords in the initiating process's command line that are indicative of malicious activity, such as downloading content or executing scripts. This rule aims to identify advanced persistent threats and malware leveraging process injection for defense evasion and privilege escalation.
Detects behavior patterns associated with Payouts King ransomware, including direct syscall-style API calls (NtAllocateVirtualMemory, NtWriteVirtualMemory, CreateRemoteThread) from processes other than trusted system binaries, and the loading of ntdll.dll from non-standard file paths (outside System32/SysWOW64). It also includes a hash-based detection for known Payouts King malicious samples.
This rule detects suspicious memory manipulation and thread injection activities directed at 'svchost.exe' or 'explorer.exe' by processes other than standard system components. Such behavior is often indicative of malicious code injection, where an attacker attempts to run arbitrary code within the address space of trusted system processes to bypass security controls or achieve persistence.
Detects Remcos RAT attempting process hollowing into common web browser executables. This rule identifies several indicators: creation of the 'Remcos_Mutex_Inj' mutex, a sequence of API calls (VirtualAllocEx, WriteProcessMemory, NtUnmapViewOfSection) targeting browser processes from a non-browser process, and the presence of a known Remcos payload MD5 hash (4924369C0BDAF73B21EB992EB9DB4DEA).
Page 32 of 55