Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
271 detections
Filters
Last updated
All Time
Detection languages
113
58
32
20
16
Contributors
115
47
32
21
7
Categories
103
84
68
64
57
Platforms
226
28
12
4
3
Products / Services
83
72
46
17
14
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
IDS Classtypes
2
1
IDS Protocols
3
This rule detects suspicious PowerShell execution patterns involving scripts or payloads stored within specific directory paths (ProgramData\WC3\ or ProgramData\wt1). It flags instances where PowerShell commands include reflective loading techniques ('IEX' or 'Invoke-Expression') while referencing files in these paths, which is often associated with fileless malware execution or malicious loaders.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Vidar In Memory Assembly
YARA-L
Identifies PowerShell dynamically converting the extracted Base64 string into bytes and loading it directly into memory.
Identifies PowerShell dynamically converting a Base64 string into bytes and loading it directly into memory, a technique often used by malware like Vidar for reflective code loading.
Detects MsBuild.exe loading memory-resident .NET assemblies post-hollowing.
Detects the MYRA RAT using memfd_create and fexecve to execute a Rust payload entirely in memory without writing an executable to disk, as observed in the Operation Friday Harvest npm supply chain campaign. The rule looks for process events where the action type indicates process creation, memory allocation, or process access, or where the FolderPath starts with '/proc/' and contains '/fd/'. It specifically targets initiating processes named 'node' or 'npm' or those with command lines associated with npm post-installation scripts. Further filtering is applied to FolderPaths matching the '/proc/\d+/fd/\d+' regex or ProcessCommandLines containing 'memfd_create' or 'fexecve', or FolderPaths containing 'memfd'.
Detects attempts to load the 'mscoree.dll' library by processes like PowerShell, setup, or main executables. This activity can indicate an in-memory .NET assembly load, often used by adversaries for stealthy execution (T1620).
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
Detects the steganographic payload extraction chain associated with the TuglaInsaatci .NET loader. The rule monitors for the sequential creation of 'payload.bin' (reconstructed from bitmap data) followed by the creation of 'Optimax.dll' on the same host, which is characteristic of the FortiBleed campaign's loader-as-a-service delivery methodology.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Identifies XWorm dynamically identifying and invoking the Run method of a reflected plugin assembly using .NET late binding. This detection specifically looks for 'LdrLoadDllApiCall' events where 'mscoree.dll' is loaded by a process whose filename matches 'Win.Kernel_Svc'.
Detects manual mapping of SbieDll.bin into memory.
Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.
Detects the in-memory execution of .NET assemblies from the Go implant using the extracted execute-assembly_windows.go structures. Specifically looks for 'mscoree.dll' being loaded by a process named 'setup.exe'.
Detects fileless Linux malware execution patterns that run payloads from anonymous memory files (memfd_create) or inherited file descriptors under /proc/self/fd without touching disk. Used by Linux backdoors and miners to evade filesystem-based detection.
Page 11 of 13