Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
271 detections
Filters
Last updated
All Time
Detection languages
113
58
32
20
16
Contributors
115
47
32
21
7
Categories
103
84
68
64
57
Platforms
226
28
12
4
3
Products / Services
83
72
46
17
14
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
IDS Classtypes
2
1
IDS Protocols
3
Detects local memory allocations changing state to PAGE_EXECUTE_READWRITE inside Go-compiled executables to execute shellcode. This behavior is indicative of reflective code loading, often used by malware to evade detection.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.
Detects reflective DLL loading technique that avoids writing files to disk
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
Detects PowerShell reading image files and loading their contents directly into memory as .NET assemblies, a stealth technique used to hide malicious payloads inside benign-looking files.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
This rule detects PowerShell commands indicative of reflective code loading, specifically looking for the use of 'Assembly' and 'Load' or 'GetType' and 'Invoke' within PowerShell command arguments. It filters out common noise associated with legitimate PowerShell operations like PSGet, Cursor, and internal Microsoft PowerShell modules to reduce false positives.
Detects usage of WinAPI functions in PowerShell scripts.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
It may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.
These techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.
Detects base64 encoded .NET reflective loading of Assembly
Detects the Deno runtime executing base64-encoded payloads via data URIs. This technique is used by threat actors, such as LeakNet, to run JavaScript payloads directly in memory, evading traditional file-based detection.
Detects the execution of the Deno runtime with specific command-line arguments used by the LeakNet group to execute a base64-encoded JavaScript payload directly in memory. This "Bring Your Own Runtime" (BYOR) technique helps evade file-based detections.
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
This rule detects activities associated with the XWorm LATAM campaign. It identifies network indicators such as specific C2 domains (jholycf100.ddns.com.br, voulerlivros.com.br, res.cloudinary.com), a specific IP address (152.249.17.145), and a destination port (7000). It also looks for the abuse of CasPol.exe making outbound connections to the identified C2 infrastructure. Furthermore, the rule detects PowerShell processes spawned by WMI (WmiPrvSE.exe) that attempt to fetch content from Cloudinary and load assemblies in memory, indicating potential in-memory execution. Finally, it includes a specific SHA256 file hash (7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5) associated with the campaign.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
Detects a low-noise XWorm execution chain described by ANY.RUN where WmiPrvSE.exe spawns PowerShell that uses WebClient to fetch Cloudinary-hosted content and performs in-memory Assembly.Load.
This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.
Page 12 of 13