Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
186 detections
Filters
Last updated
All Time
Detection languages
86
44
19
8
8
Contributors
73
17
13
12
11
Categories
102
82
41
35
35
Platforms
180
3
2
1
1
Products / Services
61
58
31
7
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects a potential process hollowing technique where 'Finalized.dll' (loaded from unconventional locations like a ComponentsFolder or System32) is used to spawn 'clspack.exe' in a suspended state from a non-standard path (e.g., AppData\Microsoft). This sequence indicates an attempt to mask malicious execution under a legitimate process name.
Detects instances where the MSBuild.exe process is subjected to image replacement or tampering, a behavior often associated with process hollowing or malicious code injection techniques aimed at evading security defenses by masquerading as a legitimate developer utility.
Detects the creation of 'explorer.exe' originating from a source process other than known legitimate parent processes like 'userinit.exe', 'winlogon.exe', or 'services.exe'. This behavioral pattern is indicative of potential process hollowing or unauthorized process injection, which is a common vector for stealers like ZigCryptoStealer to gain a foothold before performing malicious activities such as clipboard manipulation.
Detects suspicious cross-process access patterns targeting trusted system processes (svchost.exe, explorer.exe, notepad.exe) by utilizing broad process access rights (such as PROCESS_VM_WRITE and PROCESS_CREATE_THREAD). This behavior is characteristic of process injection techniques like process hollowing, often employed by loaders and malware to execute code within the context of a legitimate process.
Detects potential process injection attempts using PowerShell or CMD to execute memory manipulation operations. The rule identifies processes initiated in a suspended state that subsequently invoke Windows API calls such as WriteProcessMemory, NtUnmapViewOfSection, SetThreadContext, or ResumeThread, which are commonly associated with process hollowing or thread execution hijacking.
Detects suspicious process creation patterns indicative of process hollowing. The rule identifies processes spawned by common script interpreters (powershell.exe, wscript.exe, cscript.exe, conhost.exe) in a suspended state, followed by memory operations involving ntdll.dll and APIs such as NtUnmapViewOfSection or ResumeThread, which are characteristic of hollowing injection techniques.
Detects execution of LausivLoader by identifying suspicious process creation patterns typically associated with process hollowing. This includes a parent process (powershell.exe or conhost.exe) launching a child process in a suspended state (CREATE_SUSPENDED), followed by behavioral indicators of memory manipulation and code replacement.
Detects instances where PowerShell attempts to inject code into legitimate processes (such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe) using direct syscalls NtAllocateVirtualMemoryRemote or NtSetContextThreadRemote, indicating potential process injection activity.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the full process-hollowing sequence (suspended process creation, SetThreadContext, ResumeThread) executed against the same target PID for wab.exe or MSBuild.exe within a short window — the ACRStealer campaign's injection technique.
Detects process hollowing/injection into wab.exe, MSBuild.exe, dllhost.exe, or rundll32.exe — suspended process creation combined with SetThreadContext or NtQueueApcThread on the same process within a 5-minute window, followed by an outbound connection to known ACRStealer C2 (49.13.169.214) or renewed browser credential-store access.
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
Page 2 of 9