Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
186 detections
Filters
Last updated
All Time
Detection languages
86
44
19
8
8
Contributors
73
17
13
12
11
Categories
102
82
41
35
35
Platforms
180
3
2
1
1
Products / Services
61
58
31
7
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Identifies Havoc C2 spawning an interactive shell (cmd.exe or powershell.exe) where the parent process is a hollowed svchost.exe lacking the -k parameter.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Identifies PowerShell spawning Microsoft .NET binaries (RegAsm.exe, InstallUtil.exe, AppLaunch.exe) without command-line arguments, which is indicative of process hollowing or injection by the Codex malware to inject its final stage.
Detects the Komari agent spawning svchost.exe in a suspended state (no arguments) and writing memory into it to hide malicious execution. The rule identifies svchost.exe processes launched without the '-k' argument (indicating a suspended state) and then correlates these launches with subsequent 'WriteProcessMemoryApiCall' events targeting the same process within a one-minute window.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies process hollowing by detecting svchost.exe spawned without the mandatory -k parameter, a direct indicator of the Showboat loader injecting its telecom-targeting payload.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Detects process hollowing technique for code injection
Detects Kazuar executing process hollowing into legitimate Windows binaries like taskhostw.exe to blend in with normal OS behavior. This rule specifically looks for instances where 'taskhostw.exe' is the target process but its command line does not contain 'taskhostw.exe', indicating a potential suspended or hollowed launch, combined with network activity originating from that process.
Correlates a Valid-signed executable starting a legitimate Windows binary (e.g., svchost.exe) in a suspended state for memory injection.
This rule detects potential process injection attempts by monitoring Windows Security Event ID 4688 (A new process has been created) for specific keywords in the command line. The keywords 'CreateRemoteThread', 'WriteProcessMemory', 'VirtualAllocEx', 'SetWindowsHookEx', and 'LoadLibrary' are commonly associated with various process injection techniques. The rule summarizes these attempts by computer, user, and hourly intervals.
Detects common Windows API function names associated with process injection in command lines.
Detects process hollowing technique for code injection
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects PE injection technique using NtUnmapViewOfSection
Detects thread hijacking using SuspendThread and SetThreadContext
Detects thread hijacking using SuspendThread and SetThreadContext
Page 6 of 9