Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects process hollowing technique for code injection
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects PE injection technique using NtUnmapViewOfSection
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
Identifies the execution of the Connection.dll RAT spawning the decoy Meeting Room process, specifically looking for the loading of 'Connection.dll' and the simultaneous execution of 'SystemtUpdateTaskMachine.exe' by the same initiating process.
This rule detects suspicious activity where a malicious DLL (AggregatorHost.dll) is injected into a process that then explicitly interacts with 'steam.exe' by accessing its files. This behavior is indicative of malware targeting Steam users, potentially to steal credentials or items.
Detects delivery of process injection toolkit payloads via network
Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles
Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
This rule detects processes that repeatedly attempt to allocate memory, which can be indicative of malicious activity such as injection, evasion, or resource exhaustion attacks. It specifically looks for Event ID 4688 (process creation) where the command line contains keywords related to memory allocation (allocate, reserve, memory, malloc) and excludes common legitimate processes like SQL Server, Java, and Python. A count of 3 or more such events within an hour for the same computer, filename, and user triggers the alert.
This rule detects suspicious command-line activity indicative of direct kernel object manipulation, often associated with kernel-mode rootkits. It looks for processes executing commands containing keywords related to direct kernel access (e.g., 'directl', 'kernel call', 'ntoskrnl', 'hal.dll') in conjunction with keywords suggesting privilege escalation or driver loading (e.g., 'setprivileges', 'loaddriver', 'createremotethread'). Such combinations can signify attempts to install or interact with malicious kernel drivers or rootkits.
Detects Linux ptrace system call abuse for process injection
Detects process injection attempts targeting the OneDrive.Sync.Service.exe process. This behavior is associated with the OceanLotus SPECTRALVIPER backdoor, which uses it to maintain persistence and evade defense mechanisms.
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.
Detects KernelCallbackTable manipulation for process injection via kernel callback
Page 43 of 55