Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
196 detections
Filters
Last updated
All Time
Detection languages
78
49
15
12
10
Contributors
65
32
16
16
15
Categories
79
67
48
38
37
Platforms
189
7
2
2
Products / Services
63
55
23
15
10
MITRE Techniques
18,110
15,622
12,575
8,387
6,208
CVEs
5
IDS Classtypes
1
1
IDS Protocols
1
1
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
Detects the execution of "AccCheckConsole.exe" with command-line arguments indicative of its use for UI accessibility checking, which can be abused to load malicious DLLs. This utility allows providing a custom DLL containing a "verification routine" via the command line, enabling an attacker to inject and execute arbitrary code within the context of the legitimate `AccCheckConsole` process.
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag. This activity is suspicious when not initiated by the expected parent process, 'AppVClient.exe'.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Page 10 of 10