Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8 detections
Filters
Last updated
All Time
Detection languages
5
2
1
Contributors
4
3
1
Categories
4
3
3
2
2
Platforms
7
1
1
Products / Services
3
2
2
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
1
1
Detects processes exhibiting behaviors indicative of process injection, such as suspicious binary names, command-line arguments related to spawning sleep processes, or ptrace system calls. This rule identifies potential attempts to inject malicious code into other processes to evade defenses or elevate privileges.
Detects the execution of an injector process associated with MYRA RAT, specifically monitoring for ptrace-based process injection techniques. The rule identifies processes attempting to attach to other processes using system calls like PTRACE_ATTACH, PTRACE_PEEKDATA, PTRACE_POKEDATA, or process_vm_writev. It also flags the specific behavior of spawning a 'sleep 600' decoy process as an injection target.
Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Detects Linux ptrace system call abuse for process injection
This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
Detects manipulation of running application data via web shell commands