Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
125 detections
Filters
Last updated
All Time
Detection languages
57
23
15
13
6
Contributors
43
35
14
8
6
Categories
94
79
43
36
21
Platforms
118
6
1
1
Products / Services
43
34
9
8
5
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Fraud framework powering scam domains for crypto and gambling schemes
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
This rule detects suspicious process injection activity characterized by a sequence of API calls (VirtualAlloc, CreateRemoteThread, WriteProcessMemory) in conjunction with the loading of 'mpr.dll'. This combination of events can indicate an attempt to inject malicious code into a process, potentially for evasion or privilege escalation. The rule filters out common legitimate processes to reduce false positives.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects cross-process injection techniques associated with Remcos RAT, such as VirtualAllocEx, WriteProcessMemory, and remote thread creation. The rule identifies suspicious interaction with critical Windows system processes (e.g., explorer.exe, svchost.exe) by non-system processes, often indicative of malware injecting code to maintain persistence or evade detection.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects PowerShell script block execution (EventID 4104) that contains indicators of process injection and memory manipulation. It specifically monitors for the presence of native Windows APIs (such as NtAllocateVirtualMemory or NtCreateThreadEx), memory protection flags indicating executable/writable memory (like 0x40), and unsafe native method calls. A scoring mechanism is used to aggregate these indicators and flag suspicious scripts, commonly associated with fileless malware or offensive security tools.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects common Windows API function names associated with process injection in command lines.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Page 5 of 6