Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects AutoIt launching `jsc.exe`, matching the CastleLoader stage that hollows into `jsc.exe` per ANY.RUN analysis.
Detects the execution of "rundll32.exe" without any command-line arguments. This is highly unusual behavior, as "rundll32.exe" is intended to load and run functions from DLLs, which requires specifying a DLL path in the command line. This technique is used by malware like ValleyRAT (as part of the Winos4.0 framework) to inject modular plugins into memory.
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects process hollowing of tracerpt.exe, a technique used by the Valley RAT malware (associated with Silver Fox APT) to execute downloaded plugins. The rule identifies the creation of tracerpt.exe in a suspended state, followed by the creation of a remote thread within it, which is a strong indicator of code injection.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects potential Sliver C2 implant activity on Linux systems based on process execution patterns, such as in-memory execution via memfd or process name masquerading from temporary directories.
Detects the presence and execution of Defendnot components. This tool is used to disable Microsoft Defender by exploiting the Windows Security Center trust model, which involves injecting a malicious DLL into the trusted Task Manager process.
Detects Cobalt Strike Beacon payloads, specifically those associated with the APT24 BADAUDIO campaign, by looking for a unique watermark hash in command-line arguments or specific beacon executable/DLL names during process creation. The rule targets the Cobalt Strike Beacon watermark hash "BeudtKgqnlm0Ruvf+VYxuw==" and a generic "Watermark_Hash" string, alongside process images ending with '\beacon.exe' or '\beacon.dll'.
Detects the execution of a Python script from a non-standard user directory, using command-line parameters consistent with a tool used for Asynchronous Procedure Call (APC) injection. This specific command was observed in an AsyncRAT campaign where a script named 'ne.py' was used to inject a payload ('new.bin') into the explorer.exe process.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects the creation of a browser process in headless mode and in a suspended state. This technique is used by infostealers like AuraStealer to inject code into the browser process to bypass Application-Bound Encryption (ABE) and steal credentials.
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects the termination of Discord processes or a restart using Update.exe with the '--processStart' argument. This behavior is characteristic of the VVS Stealer, which uses this technique to inject malicious JavaScript for session hijacking.
Detects the creation of a named pipe with the format `\.\pipe\dll-%hex_encoded_PID%`. This behavior is associated with the Matanbuchus malware, which uses this technique to inject a DLL payload into a remote msiexec.exe process.
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
Detects the execution of "ClipUp.exe" with specific command-line parameters used to abuse Protected Process Light (PPL) to tamper with the Microsoft Defender process ("MsMpEng.exe"). This technique was observed in the RONINGLOADER campaign.
Detects python.exe executing from an unusual directory (e.g., a user's 'Contacts' folder) and injecting code into a benign process like notepad.exe. This is a specific behavior observed in the SERPENTINE#CLOUD campaign, where a Python-based loader is used to execute shellcode in memory.
Page 47 of 55