Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
2
Categories
1
1
1
1
1
Platforms
1
1
Products / Services
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects process argument spoofing techniques to hide true command line from forensics
This rule detects attempts to spoof process arguments to evade detection by looking for specific strings in HTTP traffic. It specifically looks for the strings "NtQueryInformationProcess" and "ProcessCommandLineInformation" (case-insensitive) in file data within established HTTP client-to-server flows. This behavior is often associated with malware or advanced persistent threats trying to hide their true command-line arguments from security tools.