Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
186 detections
Filters
Last updated
All Time
Detection languages
86
44
19
8
8
Contributors
73
17
13
12
11
Categories
102
82
41
35
35
Platforms
180
3
2
1
1
Products / Services
61
58
31
7
7
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects the execution of the .NET compiler utility 'Aspnet_compiler.exe' by a scripting engine like PowerShell or JScript/VBScript. This behavior is highly unusual and is a known technique used by malware like Agent Tesla to perform process hollowing, where the legitimate 'Aspnet_compiler.exe' process is hollowed out and injected with malicious code.
Detects the execution of rundll32.exe without any command-line arguments. This is a high-confidence indicator of process hollowing or reflective injection, as observed in campaigns distributing the Winos4.0 framework and ValleyRAT.
Detects process hollowing of tracerpt.exe, a technique used by the Valley RAT malware (associated with Silver Fox APT) to execute downloaded plugins. The rule identifies the creation of tracerpt.exe in a suspended state, followed by the creation of a remote thread within it, which is a strong indicator of code injection.
Detects process injection (e.g., process hollowing, remote thread creation) into legitimate OneDrive processes. Info-stealers use this technique to mask C2 communication as legitimate cloud traffic, bypassing network-based defenses.
Detects UserAccountBroker.exe being spawned by explorer.exe, which is an unusual parent-child relationship. The rule is enriched by looking for subsequent outbound network connections from the UserAccountBroker.exe process, a behavior observed in ValleyRAT infections.
Detects the execution of the Windows utility 'grpconv.exe' when it is spawned by a parent process located in a temporary or otherwise uncommon directory. This is an unusual parent-child relationship and is indicative of techniques like process hollowing used by malware such as the Evelyn Stealer's second-stage injector.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
Detects the legitimate Windows utility MSBuild.exe initiating any outbound network connections. MSBuild.exe is a software build tool and should not typically make network connections outside of development environments. This behavior is highly indicative of process hollowing, where malware injects itself into the MSBuild process to evade defenses, as seen in recent BlindEagle campaigns.
Detects a process changing a memory region's permissions to be readable, writable, and executable (RWX). This is highly suspicious and is often associated with malware unpacking, process hollowing, or self-modifying code. The APT29 group has been observed using a backdoor (VMTOOLS.DLL) that employs self-modifying code to evade static analysis.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries.
Detects remote thread creation initiated by specific scripting engines or Microsoft Office applications (cscript.exe, wscript.exe, mshta.exe, winword.exe, excel.exe) into processes within the SysWOW64 directory, where the start module is null. This behavior is characteristic of the CACTUSTORCH hack tool, which injects shellcode into legitimate processes to evade detection.
Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.
Detects the execution of Sysinternals PsSuspend, a utility that can be used to suspend running processes. This tool can be abused by adversaries to halt critical security processes or other applications, potentially for evasion or to facilitate further malicious activity.
Detects when a legitimate Windows binary, MSBuild.exe or mtstocom.exe, initiates an outbound network connection. This behavior is not typical for these processes and is a technique used by malware like DarkCloud to evade defenses by process hollowing.
Detects potential GTFOBins abuse on Linux systems where a root shell is spawned by a suspicious parent process (e.g., find, perl, vim, tar, etc.).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
This rule relies on DeviceProcessEvents in Microsoft Defender XDR and is intended for environments where Auditd, Sysmon for Linux, or similar native logging is not available.
Note: This detection does not cover all GTFOBins. It focuses specifically on cases where:
- A root-owned shell is spawned
- The parent process is known to be capable of shell escape or privilege abuse
- The child command appears interactive or escape-like
It does not detect:
- Non-shell-based GTFOBin techniques (e.g., file exfiltration via scp, curl, etc.)
- GTFOBin usage that doesn't result in a new shell (e.g., privilege escalation via
misconfigured capabilities)
- Abuse of GTFOBins run under non-root accounts
The query includes logic to detect both high-signal exploitation patterns and suspicious shell spawns, while excluding common false positives (e.g., package post-install scripts and benign environment checks).
Detects the ConfuserEx-protected .NET loader for DarkCloud Stealer. This loader decrypts and injects the final VB6 payload.
ICEEVENT: MSVC x64 thunk/prologue patterns + distinctive 'Servcie' error strings
Detects potential_APT-style process hollowing on Linux using syscall stubs and string camouflage
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query from file: Hunting New Variant of Snake Keylogger
Page 8 of 9