Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
A large-scale supply-chain attack where 84 compromised npm package artifacts in the tanstack namespace were modified with credential-stealing malware. The incident is tracked as part of the ongoing Mini Shai-Hulud campaign.
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
ref: https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack
Detects ctfmon.exe calling NtCreateSymbolicLinkObject or loading cldapi.dll, which indicates the initial stages of the GreenPlasma exploit. This behavior is indicative of process injection or privilege escalation attempts.
This rule detects the use of specific Linux environment variables (LD_AUDIT, LD_DEBUG, LD_DEBUG_OUTPUT) in command lines. These variables can be abused for dynamic-link library (DLL) injection or other forms of process injection, allowing adversaries to execute arbitrary code or debug processes in a way that might bypass security controls.
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
Detects potential JabGopher activity where svchost.exe is spawned by an anomalous parent process for injection. This behavior aligns with the GopherWhisper APT execution chain, specifically injecting the LaxGopher backdoor.
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
Detects the use of the Dinject PowerShell cradle based on the specific flags
Detects the creation of a named pipe as used by CobaltStrike
Detects the creation of a named pipe seen used by known APTs or malware.
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Detects the pattern of a pipe name as used by the hack tool CoercedPotato
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Detects a suspicious child process of userinit
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects instances where PowerShell spawns the fontdrvhost.exe process. This parent-child relationship is highly anomalous and is indicative of process injection, as seen in the final stage of the ClipBanker malware execution chain.
Detects uncommon processes creating remote threads.
Detects uncommon processes creating remote threads.
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Page 45 of 55