Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects cross-process memory write activity characteristic of the SPECTRALVIPER reflective injection technique. The rule identifies specific carrier processes (such as IntelAudioService.exe or OneDrive.Sync.Services.exe) that are either unsigned or spawned by a suspicious parent process, performing memory operations on other processes.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects evidence of process injection techniques associated with the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER backdoor or related tools from the Blazing Furnace campaign. The rule monitors for unauthorized code injection into legitimate host processes (e.g., OneDrive, IntelAudioService) using common Windows API patterns (VirtualAllocEx, WriteProcessMemory, CreateRemoteThread).
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects the execution of OXLOADER (aBsvwbdas.exe) which drops a maliciously crafted .ocx file (a copy of dui70.dll) into the %TEMP% directory. This behavior is indicative of module stomping to facilitate the in-memory execution of CASTLESTEALER via techniques like DonutLoader and RunPE.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Detects cross-process memory injection patterns by correlating Event Tracing for Windows (ETW) logs for VirtualAllocEx (with executable protection) and WriteProcessMemory, combined with Sysmon image load events to verify the target process has loaded user32.dll, a common indicator for GUI-related processes often targeted for injection.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Detects cross-process memory injection patterns by correlating Event Tracing for Windows (ETW) logs for VirtualAllocEx (with executable protection) and WriteProcessMemory, combined with Sysmon image load events to verify the target process has loaded user32.dll, a common indicator for GUI-related processes often targeted for injection.
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
This rule detects Vidar Stealer activity through two primary methods: a hash-based detection for a known Vidar 2.1 sample and a behavioral detection for non-standard parent processes spawning Chrome with specific command-line arguments. The behavioral detection targets Vidar's technique of using hash-resolved API calls (CreateNamedPipeA and WaitForSingleObject) to orchestrate APC injection into a suspended Chrome process for credential theft.
Detects potential process injection into Google Chrome processes using Asynchronous Procedure Calls (APC) or remote thread creation. This rule specifically looks for Chrome processes launched with specific command-line arguments (indicating a potentially controlled or sandboxed environment) that then have remote API calls like QueueUserApcRemoteApiCall, CreateRemoteThreadApiCall, or NtQueueApcThreadApiCall targeting them, originating from a different process. The AdditionalFields check for 'CryptUnprotectMemory', 'NtTestAlert', or 'NtQueueApcThreadEx2' further refines the detection of suspicious APC-related activities.
Detects the 'drun.exe' loader attempting to bypass Chrome's credential protection mechanisms. This is identified by 'drun.exe' invoking 'elevation_service.exe' (a Chrome component) or querying specific Chrome-related registry keys associated with App-Bound Encryption.
This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.
Page 36 of 55