Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
31
14
4
2
2
Contributors
11
11
10
6
5
Categories
46
17
11
9
7
Platforms
56
1
Products / Services
24
15
11
5
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects processes accessing other processes with full access rights (0x1FFFFF), often used for process injection or code manipulation prior to privilege escalation.
Detects PowerShell scripts using Windows API calls for parent process ID spoofing, enabling malicious processes to masquerade as legitimate system processes.
This rule detects suspicious DLL loads by the 'consent.exe' process. It specifically looks for known DLLs often abused in DLL side-loading or hijacking scenarios, such as 'msimg32.dll', 'version.dll', 'rtworkq.dll', 'wmsgapi.dll', and other DLLs containing 'sh4nya' or 'shanya' in their name. The rule excludes legitimate Microsoft versions of 'wmsgapi.dll' and 'msimg32.dll' based on their SHA1 hashes to reduce false positives. The 'consent.exe' process is associated with User Account Control (UAC) and its abuse can lead to privilege escalation or defense evasion.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
This rule detects the execution of tools designed for Parent Process ID (PPID) spoofing, specifically targeting Didier Stevens' 'SelectMyParent' tool. It identifies these tools through their executable name, specific command-line arguments, original file names, and known IMPHASH values. PPID spoofing is a defense evasion technique where a new process is created with a manipulated parent process ID to obscure its true origin, often to bypass security monitoring or elevate privileges.
Detection of unusual child processes (PowerShell or Command Prompt) spawned by critical system processes (winlogon.exe, services.exe, lsass.exe, csrss.exe, smss.exe, wininit.exe, spoolsv.exe, searchindexer.exe) running under an authorized user context. This behavior can indicate privilege escalation or defense evasion, especially if the spawned process is not related to legitimate network routing commands.
Detects potential token theft, impersonation, or privilege escalation activity in Windows environments by monitoring ProcessPrimaryTokenModified events. This query highlights suspicious changes in SIDs, token sources, integrity levels, or privilege flags, including attempts to impersonate SYSTEM or add high-risk privileges (SeDebugPrivilege, SeImpersonatePrivilege). Such behavior is strongly associated with lateral movement and privilege escalation techniques used by APTs, ransomware operators, and red team tooling like Mimikatz and Cobalt Strike.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
The analytic identifies a suspicious `explorer.exe` process with the `/root` command-line parameter. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process and command-line data. The presence of `/root` in `explorer.exe` is significant as it may indicate parent process spoofing, a technique used by malware to evade detection. If confirmed malicious, this activity could allow an attacker to operate undetected, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment.
Detects the use of parent process ID spoofing tools like Didier Stevens tool SelectMyParent
This rule detects unusual parent or child processes associated with 'ImagingDevices.exe' (Windows Contacts). Specifically, it looks for 'ImagingDevices.exe' being spawned by 'WmiPrvSE.exe', 'svchost.exe', or 'dllhost.exe', or for 'ImagingDevices.exe' spawning any child process. This activity has been observed in connection with Bumblebee malware operations, where adversaries might abuse legitimate processes for execution or defense evasion.
This rule detects unusual parent or child processes associated with `wab.exe` (Windows Contacts) and `wabmig.exe` (Microsoft Address Book Import Tool). These processes are typically not involved in spawning other processes or being spawned by unusual parents. The rule specifically looks for `wab.exe` or `wabmig.exe` being spawned by `WmiPrvSE.exe`, `svchost.exe`, or `dllhost.exe`, or if `wab.exe` or `wabmig.exe` themselves spawn any child processes. This behavior has been observed in connection with Bumblebee loader activity, indicating potential malicious execution or defense evasion.
Page 3 of 3