Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
186 detections
Filters
Last updated
All Time
Detection languages
86
44
19
8
8
Contributors
73
17
13
12
11
Categories
102
82
41
35
35
Platforms
180
3
2
1
1
Products / Services
61
58
31
7
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
Detects reflective process injection attempts where a suspicious executable, masquerading as 'Mixed Reality.exe' in a Windows Media Player directory, attempts to inject code into the svchost.exe system process using cross-process memory operations like CreateRemoteThread.
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
Detects process hollowing behavior indicative of the Atlas RAT loader used by TA4922. The rule monitors for the spawning of svchost.exe or notepad.exe by non-standard parent processes located outside legitimate system directories, which is a common indicator of process injection and masquerading techniques.
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects cross-process injection activity targeting Internet Explorer related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for unauthorized processes that are not signed by trusted publishers (Microsoft, Google, Mozilla) performing injection-like behavior, typically associated with Remcos RAT and its use of techniques such as process hollowing or thread execution hijacking.
Detects the LokiBot malware spawning aspnet_compiler.exe to perform process hollowing. The rule identifies this activity by monitoring process creation events and filtering out legitimate .NET build processes, targeting the specific behavior of using aspnet_compiler.exe as a host for reflective code injection.
Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
Detects instances where the DonutLoader utility performs in-memory .NET payload execution. It identifies suspicious behavior by tracking the loading of clr.dll into a process that is not a recognized .NET host, concurrent with evidence of process hollowing techniques such as memory unmapping and process writing (NtUnmapViewOfSection, WriteProcessMemory, ResumeThread).
Detects Remcos RAT attempting process hollowing into common web browser executables. This rule identifies several indicators: creation of the 'Remcos_Mutex_Inj' mutex, a sequence of API calls (VirtualAllocEx, WriteProcessMemory, NtUnmapViewOfSection) targeting browser processes from a non-browser process, and the presence of a known Remcos payload MD5 hash (4924369C0BDAF73B21EB992EB9DB4DEA).
Detects the use of specific Windows API functions or terms commonly associated with process hollowing, code injection, or advanced process manipulation within command-line strings. The monitored functions include NtCreateWaitCompletionPacket, NtAssociateWaitCompletionPacket, RtlGetCurrentPeb, ProcessPrng, and PowerRegisterSuspendResumeNotification.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Page 4 of 9