Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
125 detections
Filters
Last updated
All Time
Detection languages
57
23
15
13
6
Contributors
43
35
14
8
6
Categories
94
79
43
36
21
Platforms
118
6
1
1
Products / Services
43
34
9
8
5
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
1
IDS Protocols
1
Detects PowerShell commands that include references to memory manipulation APIs such as Reflection.Assembly, VirtualAlloc, WriteProcessMemory, and CreateThread. These APIs are often associated with advanced techniques like reflective PE injection or shellcode execution, indicating potential malicious activity.
Detects manipulation of running application data via web shell commands
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects rundll32.exe or dllhost.exe performing remote thread injection into web browser processes (chrome.exe, msedge.exe, firefox.exe). This activity is often associated with defense evasion and credential theft staging, as observed in campaigns like ClearFake/ClickFix, before a full Remote Access Trojan (RAT) is established.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the use of the PowerShell 'Add-Type' cmdlet to dynamically define a C# class containing Win32 API functions commonly used for process injection. This technique is leveraged by the Dead#Vax loader to inject its final payload, such as AsyncRAT, into the memory of legitimate processes without dropping a decrypted binary to disk.
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
Detects PowerShell scripts that dynamically define and compile C# code to access Win32 APIs associated with process injection. This fileless technique is used by malware like Dead#Vax to inject shellcode (e.g., AsyncRAT) into the memory of legitimate processes, evading disk-based detection. The rule specifically looks for the use of `Add-Type` to compile C# code that imports functions from `kernel32.dll` and utilizes `VirtualAllocEx`, `WriteProcessMemory`, and `CreateRemoteThread`.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Detects suspicious encoded payloads within WMI Event Consumers. This rule specifically looks for base64 encoded strings containing keywords commonly associated with process injection or executable characteristics, such as 'WriteProcessMemory', 'This program cannot be run in DOS mode', and 'This program must be run under Win32'. The presence of these strings in a WMI event consumer's destination property suggests an attempt to establish persistence or execute malicious code via WMI.
The following analytic detects process injection into Notepad.exe using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40 and 0x1fffff) to Notepad.exe, excluding common system paths like System32, Syswow64, and Program Files. This behavior is often associated with the SliverC2 framework by BishopFox. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code within Notepad.exe. If confirmed malicious, this could allow attackers to execute arbitrary code, potentially leading to privilege escalation or persistent access within the environment.
This analytic detects process injection into commonly abused Windows executables using Sysmon EventCode 10. It identifies suspicious GrantedAccess requests (0x40, 0x1fffff, or 0x1f3fff) to processes such as notepad.exe, wordpad.exe, calc.exe, mspaint.exe, lsass.exe, svchost.exe, and web browsers, while excluding injections originating from common system paths like System32 and Program Files. This behavior is often associated with the SliverC2 framework. Monitoring this activity is crucial as it may indicate an initial payload attempting to execute malicious code, potentially leading to privilege escalation or persistent access.
This rule detects Waiting Thread Hijacking (WTH) by identifying sequences of API calls indicative of process injection. It includes three main detection logics: a basic sequence of OpenThread, Allocate, and Write operations; a more specific API sequence that checks for THREAD_GET_CONTEXT access and two separate write operations; and a split execution variant where multiple processes target a single victim process with memory allocation, write, and protect operations. The rule aims to catch malicious code injection into remote processes.
Detects process injection into ImagingDevices.exe, a technique observed in the 'Illusory Wishes' campaign to evade detection. The threat actor used trojanized versions of Element and VLC to inject shellcode into this legitimate Windows process.
Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space.
An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way),
it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory.
Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that
most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries.
The latter should also be considered suspicious.
An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way),
it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory.
Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that
most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries.
The latter should also be considered suspicious.
The analytic detects suspicious remote thread execution in specific processes like Taskmgr.exe, calc.exe, and notepad.exe, which may indicate process injection by malware. It leverages Sysmon EventCode 8 to identify remote thread creation. This activity often signifies an attempt by malware to inject malicious code into legitimate processes, potentially leading to unauthorized code execution, privilege escalation, or persistence on the compromised host.
The analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
Detects PowerShell command lines that contain both the 'hidden' argument and specific Base64 encoded keywords. These keywords are often associated with malicious PowerShell scripts used for various post-exploitation activities, including process injection, memory manipulation, and remote thread creation. The rule aims to identify obfuscated and stealthy execution of malicious PowerShell.
Page 6 of 6