Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects a potential process hollowing technique where 'Finalized.dll' (loaded from unconventional locations like a ComponentsFolder or System32) is used to spawn 'clspack.exe' in a suspended state from a non-standard path (e.g., AppData\Microsoft). This sequence indicates an attempt to mask malicious execution under a legitimate process name.
Detects a sequence of multiple process injection-related API calls (VirtualAlloc, WriteProcessMemory, CreateRemoteThread) initiated by a process. This rule monitors for patterns indicating cross-process memory manipulation which is commonly used to inject malicious code into other processes. It specifically looks for API calls interacting with kernel32.dll and filters out known Microsoft security products.
Detects a loader module and a corresponding RIFF/WAVE file that utilizes steganography to conceal a secondary malicious payload. The loader extracts the payload from the WAV file using specific offsets and XOR decoding, then executes it in memory. This pattern is characteristic of a DLL sideloading chain involving WMPCL.dll and WPFLocalizeExtension.dll.
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Detects video and audio conferencing clients (e.g., Zoom, Microsoft Teams, Webex) loading either unsigned DLLs or DLLs commonly associated with virtual camera and audio injection tools (e.g., OBS VirtualCam, Snap Camera). This behavior is characteristic of deepfake injection techniques used to manipulate video conference participants.
Detects instances where a process spawns a child process using the exact same executable image path, specifically when the executable is located in user-writable directories such as Downloads or AppData\Local\Temp. This behavior is a common indicator of process hollowing or self-injection techniques used by malware, such as loaders that decrypt payloads in memory and then spawn a new, hollowed instance of themselves to execute the malicious code, frequently observed during post-exploitation activities.
Detects unsigned or non-standard Python processes loading core Windows system modules like kernel32.dll or ntdll.dll. This behavior is consistent with NarwhalRAT's fileless execution technique, which utilizes ctypes to interact with low-level Windows APIs (VirtualAlloc, RtlMoveMemory, CFUNCTYPE) for in-memory payload allocation and execution, bypassing traditional disk-based detection.
Detects potential Casbaneiro banking trojan activity characterized by a user accessing a known Latin American banking domain via a web browser, followed within 10 minutes by a suspicious process (RegSvcs.exe or mobsync.exe) establishing an outbound network connection, which is consistent with command-and-control (C2) behavior often seen in this malware family.
Detects memory allocation (VirtualAlloc/AllocateVirtualMemory) or protection (VirtualProtect/ProtectVirtualMemory) API calls performed with 'EXECUTE_READWRITE' permissions where the call stack is missing, unbacked, or contains unknown modules. This behavior is highly indicative of code injection techniques where an adversary attempts to execute shellcode or reflectively load a payload into memory while attempting to hide the origin of the execution.
This rule detects thread creation activities where the thread start address is spoofed to point to 'user32.dll!AnimateWindow'. This behavior is a technique used by the MinHook library (specifically in SparroWocky-style implementations) to conceal the true entry point of a thread and evade detection during process injection or thread hijacking.
Detects reflective or beacon-style in-memory process injection where an injection-type action occurs in a target process, but no corresponding file creation event is recorded by the initiating process. This behavior is indicative of fileless malware loaders or reflective COFF-based execution, commonly used in adversary techniques like BOF (Beacon Object File) execution to bypass static disk-based security controls.
This rule detects the presence and execution of known suspicious files (hashes provided) or specific malicious artifacts, such as 'hmn_hook.dll' being loaded, or the execution of binaries named 'auto.exe' and '78324.exe' associated with specific command-line arguments. It monitors file events, image loads, and process creation to identify potential malware activity.
Detects suspicious cross-process access patterns targeting trusted system processes (svchost.exe, explorer.exe, notepad.exe) by utilizing broad process access rights (such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD). This behavior is characteristic of process injection techniques like process hollowing, often employed by loaders and malware to execute code within the context of a legitimate process.
Detects a suspicious sequence where a process loads the .NET CLR (clr.dll or mscoree.dll) and shortly thereafter accesses specific low-prevalence file extensions (.raw or .pak) within high-risk directories (AppData/Local/Temp, ProgramData, or Users/Public). This behavior is characteristic of shellcode loaders (such as the WAV-shellcode loader) that decrypt and execute RAT payloads from obfuscated containers in memory. The rule intentionally excludes common desktop applications to minimize false positives.
Detects a suspicious sequence where a process loads the .NET CLR (clr.dll or mscoree.dll) and shortly thereafter accesses specific low-prevalence file extensions (.raw or .pak) within high-risk directories (AppData/Local/Temp, ProgramData, or Users/Public). This behavior is characteristic of shellcode loaders (such as the WAV-shellcode loader) that decrypt and execute RAT payloads from obfuscated containers in memory. The rule intentionally excludes common desktop applications to minimize false positives.
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects suspicious process execution patterns associated with RMMCRAT, where the Windows SmartScreen process (smartscreen.exe) spawns cmd.exe, which subsequently launches PowerShell with specific parameters for piped input/output. This behavior is characteristic of malicious code injection and command-and-control activity.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Page 6 of 55