Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects the pattern of a pipe name as used by the hack tool EfsPotato
PowerShell ShellCode
Sigma
Detects Base64 encoded Shellcode
Detects the use of CoercedPotato, a tool for privilege escalation
Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics
Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
Detects CrystalX-style browser clipper behavior when specific command-line patterns (CDP or clipper commands) appear in conjunction with a CrystalX temporary payload lineage. The temporary payload is identified by an executable named 'svc' followed by 3 to 6 digits, located in the user's AppData\Local\Temp directory.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Detects instances where dllhost.exe initiates outbound network connections to public IP addresses. Legitimate dllhost.exe processes rarely need to communicate with the internet. Such connections could indicate compromise through COM object hijacking, process hollowing, or injected code attempting to establish command and control (C2) communication.
Detects instances where dllhost.exe, which typically hosts COM objects, spawns suspicious child processes such as command shells, scripting interpreters, or reconnaissance tools. This behavior is highly indicative of COM object hijacking, process injection, or DCOM lateral movement with hands-on-keyboard activity.
This rule detects instances where 'dllhost.exe' is spawned by a parent process other than 'services.exe' or 'svchost.exe'. Dllhost.exe is typically used to host COM+ applications and should almost exclusively be initiated by these legitimate system processes. An unusual parent could indicate COM object hijacking, lateral movement, or process injection attempts.
This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.
This rule detects the execution of 'lockapphost.exe' when its parent process is not 'svchost.exe'. 'lockapphost.exe' is a legitimate Windows process responsible for displaying the lock screen and login UI. If it is spawned by an unusual parent process, it could indicate an attempt to bypass the lock screen or manipulate user interface components for malicious purposes, potentially related to persistence or defense evasion.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
Page 46 of 55