Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
2
Contributors
3
2
Categories
3
2
2
2
1
Platforms
4
3
Products / Services
3
2
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
1
IDS Protocols
3
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects process argument spoofing techniques to hide true command line from forensics
Detects KernelCallbackTable manipulation for process injection via kernel callback
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.