Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,152 detections
Filters
Last updated
All Time
Detection languages
541
211
96
75
69
Contributors
363
214
171
65
55
Categories
384
376
336
250
232
Platforms
1,096
44
8
7
3
Products / Services
448
378
89
86
36
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,152
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects ctfmon.exe calling NtCreateSymbolicLinkObject or loading cldapi.dll, which indicates the initial stages of the GreenPlasma exploit. This behavior is indicative of process injection or privilege escalation attempts.
This rule detects the use of specific Linux environment variables (LD_AUDIT, LD_DEBUG, LD_DEBUG_OUTPUT) in command lines. These variables can be abused for dynamic-link library (DLL) injection or other forms of process injection, allowing adversaries to execute arbitrary code or debug processes in a way that might bypass security controls.
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
Detects potential JabGopher activity where svchost.exe is spawned by an anomalous parent process for injection. This behavior aligns with the GopherWhisper APT execution chain, specifically injecting the LaxGopher backdoor.
Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.
Detects the use of the Dinject PowerShell cradle based on the specific flags
Detects the creation of a named pipe as used by CobaltStrike
Detects the creation of a named pipe seen used by known APTs or malware.
It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.
Detects the pattern of a pipe name as used by the hack tool CoercedPotato
Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452
Detects a suspicious child process of userinit
Detects suspicious Windows Error Reporting manager (wermgr.exe) child process
Detects instances where PowerShell spawns the fontdrvhost.exe process. This parent-child relationship is highly anomalous and is indicative of process injection, as seen in the final stage of the ClipBanker malware execution chain.
Detects uncommon processes creating remote threads.
Detects uncommon processes creating remote threads.
This rule detects suspicious files created by Microsoft Sync Center (mobsync)
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Page 45 of 55