Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects modifications to the memory protection flags of the ntdll.dll library to PAGE_READWRITE (0x04). This behavior is commonly associated with shellcode injection, hooking, or patching of core system libraries to facilitate malicious activity or evasion.
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Correlates processes executing from the Public directory utilizing VirtualAllocEx to allocate PAGE_EXECUTE_READWRITE memory, a precursor to process hollowing.
Detects malware modifying memory protections to hook AccessCheckByType to force access success.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects the MYRA RAT using memfd_create and fexecve to execute a Rust payload entirely in memory without writing an executable to disk, as observed in the Operation Friday Harvest npm supply chain campaign. The rule looks for process events where the action type indicates process creation, memory allocation, or process access, or where the FolderPath starts with '/proc/' and contains '/fd/'. It specifically targets initiating processes named 'node' or 'npm' or those with command lines associated with npm post-installation scripts. Further filtering is applied to FolderPaths matching the '/proc/\d+/fd/\d+' regex or ProcessCommandLines containing 'memfd_create' or 'fexecve', or FolderPaths containing 'memfd'.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.
This rule detects the execution of processes associated with VMware or suspicious files mimicking legitimate VMware components, particularly when spawned from web servers (w3wp.exe) or command-line interpreters (cmd.exe, powershell.exe). It monitors for specific file names and paths that may indicate persistence, lateral movement, or evasion attempts involving VMware-related binaries or configurations.
Detects the creation or opening of a named event (SyncedEventCreate, SyncedEventOpen, CreateEvent, OpenEvent) on Windows systems using the specific, potentially malicious, object name 'ShitSetupOn26126k'. This pattern often indicates inter-process communication associated with specific malware or unauthorized tool execution.
Detects cross-process activity originating from the 'nvdaHelperRemote.dll' library targeting 'svchost.exe'. This pattern is indicative of potential process injection where a malicious actor or suspicious process attempts to inject code or manipulate the memory space of a core Windows system process via this specific helper library.
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Page 40 of 55