Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,453
11,837
5,876
5,154
4,865
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects potential process injection attempts involving the Windows Update service (wusvc.exe). The rule monitors for remote thread creation or APC injection activities combined with memory operations (VirtualAlloc or VirtualProtect) that set memory regions to PAGE_EXECUTE_READWRITE, which is a common pattern for running shellcode in a hijacked process context.
Detects evidence of VILE ransomware behavior involving token and privilege manipulation, including the use of Windows API functions such as AdjustTokenPrivileges, OpenProcessToken, and DuplicateTokenEx, as well as potential EDR bypass indicators via NT syscalls like NtCreateWaitCompletionPacket.
Detects in-process memory manipulation of amsi.dll (AmsiScanBuffer/AmsiScanString) within PowerShell script block logs (Event ID 4104). This activity often involves using VirtualProtect or Marshal.Copy to apply an in-memory patch (e.g., return-early 0xC3) to neutralize AMSI scanning capabilities, which is a common technique for bypassing defensive security controls.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
This rule monitors PowerShell Script Block Logging (Event ID 4104) for command patterns indicative of Antimalware Scan Interface (AMSI) or Event Tracing for Windows (ETW) bypass techniques. These include reflective manipulation of AMSI internals (e.g., AmsiUtils, amsiInitFailed), DynamicMethod IL code generation for malicious hooks, and attempts to suppress ETW logging via the PSEtwLog provider.
Detects attempts to disable or impair Microsoft Defender Antivirus using legitimate system administration tools such as PowerShell (Set-MpPreference, Add-MpPreference), WMIC, sc.exe, or net.exe. Adversaries may use these tools to bypass security controls by disabling real-time monitoring or adding unauthorized exclusion paths.
Detects unauthorized writes to the /proc/sys/vm/drop_caches interface by non-root users or processes that are not standard system maintenance tools. This activity is a known post-exploitation technique used by exploits like the 'pedit' COW exploit to clear cached setuid binary pages in memory for evasion or cleanup.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Campaign converting compromised FortiGate firewalls into credential stealers
Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.
This rule monitors Windows Sysmon Event ID 10 (ProcessAccess) for suspicious activity where the CallTrace indicates the use of direct syscalls (bypassing standard Win32 DLL chain) or anomalous execution paths while targeting high-value processes such as security agents, system services, and critical infrastructure (e.g., lsass.exe, svchost.exe).
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
This rule detects instances where a process attempts to open a handle to itself with high-privilege access rights (e.g., PROCESS_ALL_ACCESS, PROCESS_VM_WRITE, PROCESS_VM_OPERATION). This behavior is often indicative of self-injection, a technique used by malicious code to modify its own memory space or inject shellcode, evading detection and bypassing certain security controls.
Detects cross-process memory operations and remote thread creation associated with the SPECTRALVIPER sideloading chain. It specifically flags injections originating from IntelAudioService.exe into OneDrive or svchost processes, the loading of the DtlCrashCatch.dll module, and general suspicious remote thread or memory write operations against these targets, excluding known system processes and security software.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
This rule monitors for suspicious activities related to Pluggable Authentication Modules (PAM) and authentication daemons. It detects unauthorized modifications to PAM configuration and shared object files, unexpected child processes spawned by sshd, the use of LD_PRELOAD in authentication contexts, and the tracing of authentication binaries (e.g., sshd, login, sudo) via strace.
Detects potential indicators of an SSH/PAM backdoor. This includes three behaviors: 1) SSH-related system processes writing to suspicious file paths (e.g., /tmp, /dev/shm, or hidden files in user directories), 2) PAM sessions immediately followed by suspicious file writes, and 3) successful SSH authentications for usernames previously reported as 'Invalid' by the system, suggesting a tampered PAM module allowing arbitrary authentication.
Detects unauthorized write, modification, or rename operations within Linux Pluggable Authentication Module (PAM) directories (/lib/security, /lib64/security, /usr/lib/security, /etc/pam.d). The rule identifies activity performed by processes that are not recognized package managers (e.g., apt, yum, dpkg), which is a common technique used by threat actors to inject malicious authentication modules or backdoors (e.g., pam_unix.so replacement) to hijack authentication processes.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Page 35 of 52