Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects anomalous external network connections originating from specific Windows binaries (LockAppHost, makecab, Magnify) targeted by DeepLoad's APC injection technique. These native binaries rarely initiate external public network connections.
LdrCallEnclave shellcode execution
Cortex XDR
This rule detects the use of LdrCallEnclave, a function often associated with shellcode execution, when initiated by Python or an executable located in a user-writable temporary directory (e.g., Temp, AppData, ProgramData). The detection focuses on processes whose image name matches 'python', 'python3', or any executable name followed by '.exe', and whose path contains common temporary or user-writable directories. The rule specifically looks for 'ldrcallenclave' in the command line arguments, indicating potential malicious activity such as process injection or shellcode execution.
Correlates the PowerShell process allocating virtual memory with PAGE_EXECUTE_READWRITE permissions, setting up the memory space for process hollowing.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load to execute the compiled ClassLibrary stage filelessly.
Detects execution of DbgView64.exe spawning suspicious child processes such as command interpreters (cmd.exe, powershell.exe), network utilities (net.exe), system information tools (whoami.exe), or DLL execution utilities (rundll32.exe). This behavior is indicative of Backdoor.Turn side-loading, where a legitimate application is used to load malicious code.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
Detects process injection telemetry targeting spoolsv.exe followed by an unusual svchost child or related launch from the same initiating process. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Correlates the Python loader process interacting with the hardcoded named pipe \pipe\PipePipe! used to buffer shellcode into memory.
Detects AppCertDlls registry key modification for persistent DLL injection
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Identifies when DeepLoad target processes (LockAppHost.exe, makecab.exe, Magnify.exe) spawn child processes like shells (cmd.exe, powershell.exe, whoami.exe, net.exe), indicating successful injection and post-exploitation execution. This behavior is associated with the DeepLoad malware.
Detects process hollowing technique for code injection
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects evidence of Donut shellcode execution by monitoring 'mscoree.dll' image loads initiated by Python processes. Donut is an open-source tool used to generate position-independent shellcode, often for injecting malicious payloads into memory. This rule specifically looks for scenarios where Python is used as the initiating process for loading the .NET runtime library 'mscoree.dll', which can be indicative of Donut shellcode execution.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
This rule detects processes that repeatedly attempt to allocate memory, which can be indicative of malicious activity such as injection, evasion, or resource exhaustion attacks. It specifically looks for Event ID 4688 (process creation) where the command line contains keywords related to memory allocation (allocate, reserve, memory, malloc) and excludes common legitimate processes like SQL Server, Java, and Python. A count of 3 or more such events within an hour for the same computer, filename, and user triggers the alert.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects common Windows API function names associated with process injection in command lines.
Detects ListPlanting injection using LVM_SORTITEMS and SendMessage API
Page 42 of 55