Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects the spawning of svchost.exe processes from parent processes associated with Windows Mixed Reality or NvdaHelperRemote, which may indicate malicious process injection or suspicious use of GDI screen capture APIs within a masqueraded service context.
Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.
This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.
Detects anomalous behaviors associated with the Remcos RAT watchdog, specifically the execution of host processes (svchost.exe, rmclient.exe, fsutil.exe) by non-standard parent processes, the creation of specific 'WD' or 'exepath' registry keys in HKCU\SOFTWARE used for persistence configuration, and rapid respawn patterns indicating a watchdog process restart loop.
Detects the behavior of the Remcos RAT watchdog process, which monitors the main malware execution. The rule identifies the creation of a specific registry marker (HKCU\SOFTWARE\{MUTEX}\WD) used by the watchdog for state tracking, combined with the malicious process spawning a target executable (svchost.exe, rmclient.exe, or fsutil.exe) from a standard Remcos installation directory.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects cross-process injection techniques associated with Remcos RAT, such as VirtualAllocEx, WriteProcessMemory, and remote thread creation. The rule identifies suspicious interaction with critical Windows system processes (e.g., explorer.exe, svchost.exe) by non-system processes, often indicative of malware injecting code to maintain persistence or evade detection.
Detects suspicious access to the Local Security Authority Subsystem Service (lsass.exe) process memory, indicated by Sysmon Event ID 10 with an 'UNKNOWN' call trace. This pattern is characteristic of direct syscall usage or memory injection techniques used to bypass standard Windows API hooking and security monitoring, common in credential dumping attempts.
Detects execution of a SimpleRunPE-style loader from common user-writable directories such as Downloads, Temp, AppData, or Public paths. This behavior is often associated with malware attempting to evade detection by executing from non-standard locations.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
Detects potential Antimalware Scan Interface (AMSI) bypass attempts where a process loads amsi.dll followed by suspicious memory modification operations (e.g., VirtualProtect, WriteProcessMemory) targeting the AmsiOpenSession function or the amsi.dll memory space. This is a common technique used by malware like DcRAT and various loaders to neutralize endpoint security visibility.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects the loading of the system dynamic link library USER32.dll by a process executing from a suspicious directory within AppData\Roaming\Traiolx Custom Utils\. This behavior is consistent with potential DLL side-loading or process injection attempts where a process residing in a non-standard or user-writable location attempts to interact with critical OS system modules.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
This rule detects attempts to inject malicious DLLs into common Windows processes such as svchost.exe, explorer.exe, lsass.exe, and winlogon.exe. The detection is based on the loading of DLLs with suspicious names like 'hook.dll', 'inject.dll', 'payload.dll', or 'stage.dll' by these processes, which is indicative of process injection techniques often used by malware like Remcos RAT.
Page 37 of 55