Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects the execution of the DInjector PowerShell cradle, identified by specific command-line arguments '/am51' and '/password'. This tool is often used for process injection and privilege escalation.
This rule detects potential DLL injection or execution attempts using 'Tracker.exe', a legitimate Microsoft binary that can be abused. The detection specifically looks for 'Tracker.exe' being executed with command-line arguments '/d' or '/c', which are indicative of its use in loading or executing DLLs. It filters out common false positives related to MSBuild processes.
The analytic detects the use of `GetProcAddress` within PowerShell script blocks, captured via PowerShell Script Block Logging (EventCode=4104). The presence of `GetProcAddress` in PowerShell is often indicative of malicious activity, such as process injection or other code execution techniques, as it allows for dynamic resolution of API functions. This behavior is unusual for legitimate PowerShell scripts and suggests an attacker is attempting to execute arbitrary code, potentially leading to system compromise. Analysts should investigate the full script block and any associated processes.
This analytic detects the creation or connection to a named pipe associated with Trickbot malware. It specifically looks for Sysmon EventCodes 17 (Pipe Created) and 18 (Pipe Connected) where the PipeName matches the pattern "\\pipe\\*lacesomepipe". This activity is significant because Trickbot uses named pipes for inter-process communication, often for C2 communication, data exfiltration, and command execution. Detecting this behavior can help identify Trickbot infections, which could lead to persistence, arbitrary command execution, and sensitive information exfiltration.
The analytic detects instances of `searchprotocolhost.exe` running without command line arguments but with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because `searchprotocolhost.exe` typically runs with specific command line arguments, and deviations from this norm can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to establish network connections for command and control, potentially leading to data exfiltration or further system compromise.
The following analytic detects instances of searchprotocolhost.exe running without command line arguments. This behavior is unusual and often associated with malicious activities, such as those performed by Cobalt Strike. The detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process execution data. This activity is significant because searchprotocolhost.exe typically runs with specific arguments, and its absence may indicate an attempt to evade detection. If confirmed malicious, this could lead to unauthorized code execution, potential credential dumping, or other malicious actions within the environment.
This rule detects the creation of remote threads by a specific list of uncommon processes. These processes are often legitimate Windows executables or common applications that are not typically expected to create remote threads in other processes. Such activity can be indicative of process injection techniques used by adversaries for defense evasion or privilege escalation. The rule includes filters to reduce false positives from known legitimate remote thread creations by some of these processes.
The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
This analytic detects process injection into commonly abused Windows executables using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40, 0x1fffff, or 0x1f3fff) to processes such as notepad.exe, wordpad.exe, calc.exe, mspaint.exe, lsass.exe, svchost.exe, and web browsers, while excluding injections originating from common system paths like System32 and Program Files. This behavior is often associated with the SliverC2 framework. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code, potentially leading to privilege escalation or persistent access.
This rule detects the creation of processes where the command line or image path explicitly references the 'Sysnative' folder (e.g., 'C:\Windows\Sysnative\'). This behavior is often observed in malware, particularly Cobalt Strike, to bypass WoW64 file system redirection and execute 64-bit binaries from a 32-bit process. The rule includes filters to reduce false positives from legitimate applications like .NET's ngen.exe and XAMPP's use of cmd.exe within Sysnative.
This rule detects instances where 'WerFaultSecure.exe' is launched by an unusual parent process. 'WerFaultSecure.exe' is a legitimate Windows error reporting tool, but its execution by non-standard parent processes can indicate malicious activity, such as process injection, credential dumping, or defense evasion. The rule assigns a suspicion score based on the parent process and command-line parameters, filtering for medium to critical risk levels. It also extracts the target PID and identifies suspicious parameters or dump types.
Detects attempts to suspend or terminate Endpoint Detection and Response (EDR) agent processes by targeting their Process IDs (PIDs). The rule identifies suspicious command-line arguments and tools (e.g., procdump, WerFault) used to interact with processes, specifically looking for these actions against a predefined list of common EDR agent executable names. It correlates process creation events with process ID resolution to identify the targeted EDR agent.
This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by these processes. Binaries such as `rundll32.exe`, `regsvr32.exe`, `dllhost.exe`, `svchost.exe`, and others are legitimate Windows processes that are often injected into by malware or post-exploitation frameworks (e.g., Cobalt Strike) to hide execution. When these processes are seen initiating a network connection with an empty or missing command line, it can indicate potential injection and communication with a command and control server.
This analytic detects network connections initiated by binaries that are not typically associated with network communication, such as 'notepad.exe', 'calc.exe' or 'write.exe'. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
exe launched by dll with ReflectiveLoader export function
powershell with enco parameter launched by winword / excel / powerpoint
Detects PowerShell preparing to execute shellcode using the CallWindowProc API. This technique is used to bypass EDRs by executing code without creating a new thread, which is a commonly monitored API call.
This analytic identifies suspicious child processes spawned by `WScript.exe` or `CScript.exe`. Adversaries and malware commonly use these scripting hosts to execute various Living Off the Land Binaries (LOLBINs), other scripts like PowerShell, or to spawn suspended processes for code injection as a defense evasion technique. While this TTP may detect some legitimate scripts that utilize the listed child processes, it serves as a strong indicator that a script might be executing suspicious code.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
Detects a process opening a handle to a thread with rights to set the thread's context. This is a key indicator of thread hijacking techniques, where an adversary manipulates a waiting thread in a legitimate process to execute malicious code.
Page 49 of 55