Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects a potential process hollowing technique where 'Finalized.dll' (loaded from unconventional locations like a ComponentsFolder or System32) is used to spawn 'clspack.exe' in a suspended state from a non-standard path (e.g., AppData\Microsoft). This sequence indicates an attempt to mask malicious execution under a legitimate process name.
Detects a suspicious staging behavior associated with OnyxC2 premium-tier malware. The detection identifies a process respawning itself—a common precursor to hidden VNC or credential access activity—followed by the execution of Microsoft Edge with specific utility flags typically used to masquerade as an indexing component. This pattern is characteristic of techniques used to hijack authenticated browser sessions for C2 purposes.
Detects instances where the legitimate Windows Character Map utility (charmap.exe) is spawned by suspicious processes or PowerShell, and subsequently loads clr.dll. This behavior is indicative of potential DLL sideloading or process injection techniques used by malware to execute arbitrary code within a trusted system process context.
Detects potential process injection attempts using PowerShell or CMD to execute memory manipulation operations. The rule identifies processes initiated in a suspended state that subsequently invoke Windows API calls such as WriteProcessMemory, NtUnmapViewOfSection, SetThreadContext, or ResumeThread, which are commonly associated with process hollowing or thread execution hijacking.
This rule detects the loading of the 'Microsoft.Management.Configuration.dll' module by specific Windows system processes involved in package management and configuration, namely 'ConfigurationRemotingServer.exe' and 'WindowsPackageManagerServer.exe'. While these are legitimate components of the Windows Package Manager and DSC services, monitoring this activity can establish a baseline for identifying potential process injection or unauthorized library loading within these security-sensitive management binaries.
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
This rule detects potential PowerShell script execution without spawning the standard powershell.exe process. It monitors for the loading of clr.dll and System.Management.Automation.dll into any process other than powershell.exe, which is a technique used by some malware families like SloppyRAT to execute PowerShell code directly within a compromised process memory space.
Detects the presence of PIVOTPIPE loader artifacts, specifically the COFF sleep-mask object file (sleepmask.o) and its associated debug log (nb_sleep_dbg.txt), which are written to a randomly named subfolder within the Windows temporary directory as part of a sleep-obfuscation evasion sequence.
Detects high-frequency calls to the VirtualProtect API where memory protections are changed to read/write (PAGE_READWRITE) or executable read/write (PAGE_EXECUTE_READWRITE). This behavior is often indicative of process injection techniques or self-modifying code associated with unpacking, loading shellcode, or tampering with process memory.
Detects the creation of 'explorer.exe' originating from a source process other than known legitimate parent processes like 'userinit.exe', 'winlogon.exe', or 'services.exe'. This behavioral pattern is indicative of potential process hollowing or unauthorized process injection, which is a common vector for stealers like ZigCryptoStealer to gain a foothold before performing malicious activities such as clipboard manipulation.
Detects instances where processes (excluding known legitimate .NET processes) load common .NET runtime modules (e.g., clr.dll, mscoree.dll) followed by remote process injection or handle-based process access, which is often indicative of reflective assembly loading used by loaders like PIVOTPIPE to execute malicious code within a target process.
This rule detects the creation of named pipes with names that match default or commonly customized patterns used by Cobalt Strike Beacons for inter-process communication (IPC) and lateral movement. The detection specifically targets common pipe naming conventions such as those starting with 'msagent_', 'MSSE-', 'postex_', 'status_', and 'mypipe-', which are frequently observed in Cobalt Strike configurations.
This rule detects potentially malicious in-memory activity within the 'GRrte.exe' process, specifically targeting behaviors associated with PlugX malware. It monitors for suspicious memory protection changes (e.g., requests for Read-Write-Execute permissions) and the loading of the 'ws2_32.dll' library, which is commonly used to facilitate network communication in side-loaded payloads.
Detects process injection and hook evasion attempts where a thread is created or modified with a start address that does not resolve to a known, legitimate memory module. This pattern is indicative of shellcode execution or reflective DLL injection where the malicious code resides in anonymous or unbacked memory regions.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects instances of process injection targeting the 'attrib.exe' process. This behavior is associated with the Sauron Loader, which performs in-memory shellcode execution by allocating memory and creating a remote thread within a legitimate process, such as 'attrib.exe', to avoid writing payloads to disk.
Detects instances where PowerShell initiates process injection behaviors, specifically targeting common user-facing applications such as browsers (chrome.exe, msedge.exe), build tools (csc.exe), or indexing services (SearchIndexer.exe). The rule identifies memory allocation and thread manipulation activities often associated with reflective code injection or memory-based payloads.
This rule detects unauthorized memory modification of ntdll.dll, specifically targeting the EtwEventWrite function, by identifying processes writing to memory regions with execution-permission flags (e.g., PAGE_EXECUTE_READWRITE). This behavior is characteristic of adversaries attempting to blind Event Tracing for Windows (ETW) telemetry, often following suspicious .NET assembly loading (such as Assembly.Load) typical of malware loaders like LausivLoader.
The following analytic detects potential process injection attempts into executables that are commonly abused leveraging Sysmon EventCode 10.
It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
This activity was associated with the SliverC2 framework by BishopFox.
Monitoring this activity may indicate an initial payload attempting to execute malicious code.
It identifies Access Mask requests (0x40 and 0x1fffff) to processes such as notepad.exe, wordpad.exe and calc.exe, excluding common system paths like System32, Syswow64, and Program Files.
This activity was associated with the SliverC2 framework by BishopFox.
Monitoring this activity may indicate an initial payload attempting to execute malicious code.
This rule detects the invocation of the undocumented ntdll.dll function 'EtwpCreateEtwThread'. This API call can be abused by adversaries as an alternative to standard thread creation APIs (like CreateThread) to execute shellcode or malicious code in a suspicious process context, often as part of process injection techniques.
Detects sophisticated shellcode execution patterns characteristic of MovieReaper, specifically monitoring for the combination of RWX memory protection allocation, manipulation of Vectored Exception Handlers (VEH), and usage of manual syscall stubs (NtProtectVirtualMemory) to bypass EDR user-mode API hooking.
Page 8 of 55