Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
428 detections
Filters
Last updated
All Time
Detection languages
200
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
424
3
1
1
Products / Services
180
159
26
18
16
MITRE Techniques
406
338
222
96
94
CVEs
2
Detects password dumper activity by monitoring remote thread creation (EventID 8) where the target process is 'lsass.exe'. The process initiating the remote thread is the malicious program. A single execution of such a tool can generate numerous events.
This rule detects PowerShell scripts attempting to use specific Windows API functions that are commonly associated with malicious activities such as process injection (VirtualAlloc, OpenProcess, WriteProcessMemory, CreateRemoteThread), token manipulation (OpenProcessToken, LookupPrivilegeValue, AdjustTokenPrivileges, DuplicateTokenEx), and memory operations (ReadProcessMemory, VirtualFree). Detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects potential remote thread injection activities associated with the Bumblebee malware. Specifically, it looks for instances where 'wabmig.exe', 'wab.exe', or 'ImagingDevices.exe' create a remote thread in 'rundll32.exe'. This behavior is indicative of how Bumblebee operates to execute its malicious payload.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Detects the creation of a remote thread from a PowerShell process (powershell.exe or pwsh.exe) into another process. This activity can be indicative of process injection techniques used by adversaries to execute malicious code or evade defenses. A filter is included to exclude known legitimate activity from CompatTelRunner.exe.
Detects remote thread creation in "KeePass.exe" which could indicates potential password dumping activity
Detects remote thread creation by PowerShell processes into "lsass.exe"
Detects password dumper activity by monitoring remote thread creation EventID 8 in combination with the lsass.exe process as TargetImage.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
The process in field Process is the malicious program. A single execution can lead to hundreds of events.
Page 21 of 21