Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
186 detections
Filters
Last updated
All Time
Detection languages
86
44
19
8
8
Contributors
73
17
13
12
11
Categories
102
82
41
35
35
Platforms
180
3
2
1
1
Products / Services
61
58
31
7
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
This rule detects suspicious attempts by non-browser processes to access Google Chrome's process memory or create threads within it. This behavior is often indicative of process injection techniques used by malware to hook into or extract data from the browser, potentially for credential theft or session hijacking. The rule specifically looks for API calls like OpenProcess, NtCreateProcessEx, CreateRemoteThread, NtReadVirtualMemory, and ReadProcessMemory targeting 'chrome.exe' by processes other than Chrome itself or its legitimate update/driver executables.
Detects suspicious child processes spawned in a suspended state, indicative of process hollowing. The rule specifically targets legitimate Windows system processes (svchost.exe, explorer.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe, msiexec.exe, regsvr32.exe) when they are spawned by non-system parent processes originating from user-writable paths like AppData, Temp, Roaming, ProgramData, or Desktop. This behavior is commonly associated with malware like Remcos RAT.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects network connection activity originating from a host to the hardcoded IP 62.102.148.212 on port 37393, which is identified as a command and control (C2) endpoint for Remcos RAT. This communication is often associated with process hollowing where the malware hides within legitimate browser processes.
Detects the OXLOADER malware dropping a malicious copy of dui70.dll renamed as a random .ocx file into the user's temporary directory. The rule identifies subsequent loading of this dropped file via LoadLibraryA, which is indicative of module stomping techniques where malicious code in an added .xtext section is executed within the context of a legitimate system component.
Identifies PowerShell utilizing ProcessHollowing.Execute to hijack MsBuild.exe.
Detects AutoHotkey (AHK) scripts spawning specific .NET Framework processes (cvtres.exe, AddInProcess32.exe, AppLaunch.exe, aspnet_compiler.exe), which is indicative of process hollowing, often used by malware like AsyncRAT to inject malicious code into suspended legitimate processes.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
Identifies RuntimeHost.exe spawning legitimate Microsoft .NET binaries (InstallUtil.exe) in a suspended state (no arguments) to hollow and inject miner shellcode.
Correlates the executing Matanbuchus DLL performing process hollowing or injection into legitimate Windows binaries (e.g., svchost.exe, dllhost.exe) to execute AstarionRAT. This rule specifically looks for 'rundll32.exe' as the initiating process, targeting 'svchost.exe', 'dllhost.exe', or 'WerFault.exe' as the child process, and where the command line of the child process does not contain typical command-line arguments (hyphens or slashes), which can be indicative of process hollowing where the legitimate binary is started without its usual parameters before being injected.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
Detects AutoHotkey scripts injecting into legitimate .NET binaries for defense evasion, specifically targeting processes associated with AsyncRAT. The rule looks for AutoHotkey.exe or command lines containing '.ahk' initiating processes that are known .NET binaries like AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe.
Identifies the fake VPN installer executing process hollowing, spawning suspended legitimate .NET binaries (RegAsm.exe, InstallUtil.exe) to inject the Vidar or Lumma stealer payload.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Page 5 of 9