Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects instances where common Windows system processes (dllhost.exe, mmc.exe, svchost.exe) spawn known living-off-the-land binaries (LotLBin) or command-line interpreters. This behavior is often indicative of process injection or malicious activity where an adversary leverages trusted system processes to execute commands or malicious scripts.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
This rule monitors for suspicious child processes (like cmd.exe, powershell.exe, wscript.exe, or rundll32.exe) spawned by dllhost.exe. Dllhost.exe is typically a legitimate Windows process for COM object hosting, and it spawning command-line interpreters or administrative utilities is often indicative of malicious activity, such as process injection or lateral movement.
Detects the creation of a randomly named .ocx file in temporary directories (AppData\Local\Temp or Windows\Temp) followed by its loading by a process. This behavior is indicative of OXLOADER malware staging shellcode, where 'dui70.dll' is often copied and renamed to a .ocx file. Exclusions are in place for common legitimate processes like msiexec.exe and regsvr32.exe.
Detects Vidar Stealer's technique of bypassing Chrome's Application-Bound Encryption by spawning a suspended Chrome instance with specific command-line flags for APC-based CryptUnprotectMemory injection, combined with accessing Chrome credential files (Login Data, Cookies, Local State) for cookie and password theft. This rule correlates process creation events of Chrome with suspicious command-line arguments and file access events to Chrome's credential stores by the same initiating process within a short time frame.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
Detects the loading of specific DLLs (7z.dll, normaliz.dll) from user-writable directories like AppData, Temp, Roaming, or Local, excluding legitimate installations of 7-Zip or Windows system directories. This behavior can indicate DLL sideloading or other forms of malicious code execution where an attacker places a malicious DLL in a location that a legitimate application will load.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
Detects generic instances of scripting languages (Python/PowerShell) leveraging anomalous named pipes (e.g., PipePipe!, postex) to inject or execute shellcode directly in memory.
This rule detects suspicious activities related to the exploitation of an insecure named pipe (ScriptLogic_Server_NamedPipe_9300) in Quest KACE Desktop Authority, identified as CVE-2025-67813. It covers three main branches: 1) Suspicious child processes (like command interpreters or scripting engines) spawned by Desktop Authority agents running as SYSTEM, indicating potential arbitrary code execution. 2) Access to the 'ScriptLogic_Server_NamedPipe' by processes other than the legitimate Desktop Authority agents, suggesting unauthorized interaction with the vulnerable named pipe. 3) Process injection or cross-process access attempts targeting Desktop Authority agent processes, which could be used to gain control or escalate privileges.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.
Detects suspicious execution patterns involving SystemSettings.exe, specifically when spawned by uncommon binaries (xwreg.exe or xgdf.exe) or when performing thread creation operations, which may indicate process injection or suspicious lateral movement attempts.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects potential PPID spoofing and process injection activity associated with SharkLoader and Cobalt Strike. The rule monitors for cross-process injection into critical system processes or shell spawning from suspicious directories (AppData/Roaming or ProgramData/KasperskyLab), typically used by SharkLoader to stage payloads or perform parent process spoofing.
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
Detects instances where suspicious, non-Windows-standard processes (residing outside of System32 or SysWOW64) spawn or interact with critical system processes like svchost.exe or explorer.exe. This activity is indicative of process injection techniques used by malware loaders, such as SharkLoader, to execute malicious code within the context of trusted system processes to maintain persistence or elevate privileges.
Detects anomalous file activity and process execution associated with the SharkLoader malware family. The rule looks for the loading of specific component files (DscCoreR.mui, SyncRes.dat, SystemSettings.dll) from suspicious directories, as well as the execution of SystemSettings.exe from non-standard AppData or ProgramData paths, which indicates a beacon injection or execution chain.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
Page 39 of 55