Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
271 detections
Filters
Last updated
All Time
Detection languages
113
58
32
20
16
Contributors
115
47
32
21
7
Categories
103
84
68
64
57
Platforms
226
28
12
4
3
Products / Services
83
72
46
17
14
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
IDS Classtypes
2
1
IDS Protocols
3
Detects the Havoc Demon utilizing execute-assembly to load post-exploitation .NET tooling (like Seatbelt or SharpHound) directly into memory without touching disk. This rule identifies processes loading 'mscoree.dll' (a .NET runtime component) and subsequently making network connections to non-localhost IP addresses, indicating potential in-memory .NET execution with C2 communication.
This rule detects the suspicious behavior where the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library into memory without any corresponding file creation or modification events for that DLL. This pattern is indicative of reflective code loading or fileless execution techniques often associated with Backdoor.Mistic (MLTBackdoor), where malicious code is executed directly from memory to evade disk-based security controls.
Detects a multi-stage in-memory delivery chain associated with Operation Poisson, where wscript.exe spawns powershell.exe to load and execute the Havoc Demon agent in memory via a VBScript stager.
This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects cross-process memory write activity characteristic of the SPECTRALVIPER reflective injection technique. The rule identifies specific carrier processes (such as IntelAudioService.exe or OneDrive.Sync.Services.exe) that are either unsigned or spawned by a suspicious parent process, performing memory operations on other processes.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects the execution of Red Lamassu's JFMBackdoor payload by monitoring for fltMC.exe being launched from temporary directories. The rule identifies a sideloading technique where fltMC.exe loads a malicious FLTLIB.dll, which then injects the flt.bin shellcode stub into memory, avoiding writing the malicious PE file to disk.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
Detects the execution of OXLOADER (aBsvwbdas.exe) which drops a maliciously crafted .ocx file (a copy of dui70.dll) into the %TEMP% directory. This behavior is indicative of module stomping to facilitate the in-memory execution of CASTLESTEALER via techniques like DonutLoader and RunPE.
Detects the loading of .NET assemblies (DLL, OCX, EXE) from user-writable directories such as AppData\Local\Temp or AppData\Roaming by processes that are not standard .NET development tools. This behavior is often associated with malware loaders, such as OXLOADER, that perform module stomping or use steganographic techniques to execute malicious code in memory via AppDomain.Load.
Detects the loading or access of specific DLLs (Optimax.dll or System Optimizer Ultimate.dll) by processes originating from user-writable directories (AppData or Temp), which is characteristic of the TuglaInsaatci campaign utilizing steganographic techniques to deploy Remcos RAT.
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
Detects the use of reflective .NET assembly loading in PowerShell script blocks. This technique, commonly utilized by the LokiBot information stealer, allows attackers to load and execute malicious .NET payloads directly in memory, bypassing the need to write files to disk.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
Detects UAC bypass activity associated with BeepRAT (Operation DragonClone) which involves modifying registry keys associated with auto-elevating Windows binaries (fodhelper, eventvwr, sdclt, ComputerDefaults), followed by the execution of these binaries and the subsequent loading of DLL/bin payloads from user-writable AppData directories. The rule also detects reads of the 'Creeper' registry key used for BeepRAT C2 configuration.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.
Detection of the ark.x64.dll performing reflective code loading of the Cobalt Strike beacon into memory.
Detects PowerShell referencing AMSI internals, reflection, or amsiInitFailed before executing a downloaded stage. This rule specifically looks for PowerShell processes executing commands that contain keywords related to AMSI bypass techniques, such as 'AmsiUtils', 'amsiInitFailed', 'AmsiScanBuffer', 'amsiContext', 'GetField', combined with 'SetValue', 'Reflection', or 'NonPublic'. This indicates an attempt to modify AMSI's behavior in memory.
Page 10 of 13