Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects a specific Donut-generated shellcode sample based on its SHA256 hash. This shellcode is known to employ techniques like position-independent code to execute .NET assemblies.
Detects a position-independent code (PIC) technique commonly used in shellcode, such as that generated by the Donut tool. This technique uses a 'call $+5' followed by a 'pop' to determine the current instruction pointer's address.
This rule detects advanced memory exploitation techniques, including anomalous memory protection changes (non-executable to executable), writes to executable memory regions within the same process, large executable memory allocations followed by network activity, and potential format string exploit attempts in web logs. It aims to identify behaviors indicative of bypassing ASLR and DEP.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
Detects highly unusual network connections initiated by notepad.exe. This behavior is suspicious because notepad.exe is a simple text editor not designed for network communication. This technique has been observed in campaigns where threat actors inject shellcode into a suspended notepad.exe process to establish command and control (C2) connections.
This rule detects suspicious execution of MSBuild.exe from non-standard user-writable temporary or roaming directories. Adversaries often abuse MSBuild.exe, a legitimate Microsoft utility, to proxy execution of malicious code, bypassing application control defenses. The rule specifically looks for MSBuild.exe running from common temporary or user-controlled paths like AppData\Local\Temp, AppData\Roaming, C:\Temp, or C:\Users\Public, which is indicative of potential malicious activity such as process injection or execution of infostealers like Lumma Stealer.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Actions:
Review the parent process (InitiatingProcess*) for suspicious names and command lines.
Correlate with other indicators such as network connections, file writes, or registry changes.
Investigate the dropped files or payloads around the execution timestamp.
Detects uncommon processes creating remote threads. This rule specifically looks for remote thread creation events where the source image is one of a predefined list of common Windows executables (explorer.exe, iexplore.exe, msiexec.exe, powerpnt.exe, schtasks.exe, winlogon.exe) and filters out known legitimate behaviors for these processes to reduce false positives. This activity can be indicative of process injection techniques used by malware or adversaries.
Search Common EventCodes (EventID’s) for Suspicious Behavior
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
KQL Query
Detects uncommon processes creating remote threads.
The following analytic detects instances of DLLHost.exe running without command line arguments while establishing a network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network activity data. It is significant because DLLHost.exe typically runs with specific arguments, and its absence can indicate malicious activity, such as Cobalt Strike usage. If confirmed malicious, this activity could allow attackers to execute code, move laterally, or exfiltrate data, posing a severe threat to the network's security.
SPL Query
Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE".
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects uncommon processes creating remote threads.
Detects the process injection activity of the malicious Havoc conhost.exe variant, specifically the creation of a remote thread within a cmd.exe process. This is a key step where the Havoc payload is injected and executed, as described by Fortinet.
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.
Detects PowerShell script blocks containing function definitions or .NET method calls commonly used by Cobalt Strike PowerShell loaders for dynamic API resolution, memory allocation, and shellcode execution. This rule is based on analysis from the provided reference.
Page 50 of 55