Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
This detection identifies instances where critical Windows kernel files (ntoskrnl.exe, ntoskml.exe, ntoskrnl64.exe) are executed or manipulated outside of standard system directories (e.g., C:\Windows\System32, C:\Windows\WinSxS). It focuses on processes exhibiting suspicious behaviours such as code injection, driver loading, hooking, or memory mapping/unmapping, while excluding benign system processes like services.exe, trustedinstaller.exe, and dism.exe. It also filters out temporary files created by common browsers (e.g., Chrome, Edge) to reduce false positives. This activity is indicative of potential malicious kernel-level manipulation, such as unauthorised drivers, rootkits, or other advanced persistent threats attempting to bypass security controls.
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
Detects the Visual Basic Compiler (vbc.exe) initiating DNS queries. This is highly anomalous behavior, as vbc.exe is a compiler and should not be making network connections. This technique is used by malware like Lokibot for defense evasion after process injection.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
This rule detects an unauthenticated command injection vulnerability (CVE-2025-25256) in Fortinet FortiSIEM's phMonitor component. The detection is based on specific byte sequences and a PCRE regex matching command injection characters within the 'archive_nfs_archive_dir' parameter in TCP traffic to port 7900.
SesameOP Uses OpenAI Assistants API as a mechanism for command-and-control (C2) communications. Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised environment. To do this, a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.
Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.
This rule detects suspicious child processes spawned by 'msra.exe' (Microsoft Remote Assistance). Adversaries have been observed using msra.exe for process injection, discovery, and persistence. The rule specifically looks for common command-line utilities being executed as child processes of msra.exe, which could indicate malicious activity.
Detects the execution of GuLoader malware where a rundll32.exe process is spawned by an injected browser process (chrome.exe, firefox.exe, or msedge.exe). This behavior indicates potential malware activity, specifically GuLoader initiating network connections.
Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command. This technique leverages the /proc filesystem to modify a running process's memory, which can be used for privilege escalation or defense evasion.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". This is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects the execution of 'more.com' as a parent process and 'vbc.exe' as a child process. This specific process tree behavior has been observed in samples related to the Lummac Stealer, where the Lummac payload is injected into the 'vbc.exe' process.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Detects suspicious execution of rundll32.exe with command-line arguments that indicate the invocation of inline VBScript. This behavior has been observed in attacks attributed to UNC2452 (APT29/NOBELIUM), specifically using patterns like 'Execute', 'RegRead', and 'window.close' within the command line to execute malicious VBScript.
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.
This rule detects when the 'notepad.exe' process initiates a network connection. This behavior is highly unusual for Notepad and can indicate malicious activity such as process injection where a beacon or other malicious code is running within the legitimate Notepad process to establish command and control. Notepad typically only initiates network communication when printing documents, which is filtered out by this rule.
This rule detects process injection activities originating from Microsoft Word (winword.exe) that are characteristic of a LittleCorporal generated malicious document. Specifically, it looks for winword.exe as the source image performing process access, combined with a call trace that includes a .NET Framework 64-bit v2.x path and an 'UNKNOWN' module, which is indicative of injected code.
Detects an anomalous execution of 'dllhost.exe' where the process spawns without any command-line arguments. This behavior is highly unusual for legitimate 'dllhost.exe' processes and can indicate malicious activity such as process injection or malware attempting to masquerade as a legitimate system process.
Page 48 of 55