Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
42 detections
Filters
Last updated
All Time
Detection languages
13
10
10
6
1
Contributors
12
7
7
5
2
Categories
16
13
8
6
6
Platforms
36
6
2
Products / Services
20
10
8
6
2
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
1
IDS Classtypes
4
1
1
IDS Protocols
5
1
Identifies the browser extension utilizing the native messaging bridge to launch execution commands outside the sandbox, specifically looking for Microsoft Edge processes initiating commands containing 'open_native_messaging'.
Detects the Lunar Client launcher or associated Java processes spawning suspicious utility processes, which may indicate exploitation of an Electron-based inter-process communication vulnerability where an attacker manipulates the gameDirectory path to achieve arbitrary code execution.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
This rule detects attempts to inject OLE (Object Linking and Embedding) objects into web requests, specifically looking for the keywords 'CLSID' and 'ProgID' within the HTTP client body. This technique can be used for inter-process communication and potentially lead to arbitrary code execution or other forms of attack.
This rule detects suspicious inter-process communication (IPC) activity involving named pipes. Specifically, it looks for network traffic within the home network ($HOME_NET to $HOME_NET) that contains the string "\\.\pipe\\" (case-insensitive) and has a data payload size greater than 1000 bytes. This pattern is often associated with malware or advanced persistent threats (APTs) using named pipes for communication, especially when large amounts of data are transferred, indicating potential data exfiltration or command and control (C2) activity.
Detects high-volume RPC endpoint mapper requests indicating inter-process communication abuse
Detects the creation of the specific named pipe 'MiniPlasmaWERPipe' utilized by the MiniPlasma Local Privilege Escalation (LPE) proof-of-concept for SYSTEM process communication.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects potential DCOM lateral execution attempts. It specifically looks for TCP traffic to port 135 (typically used by DCOM/RPC) on the home network, containing the byte sequence '|05 00 0b|' within the first 3 bytes of the payload. A threshold of 5 occurrences from the same source within 30 seconds is set to reduce false positives.
Detects the creation or connection to the named pipe '\REDSUN' which is known to be used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This rule monitors both Microsoft Defender for Endpoint events and Sysmon Event IDs 17 and 18 for named pipe activity.
This rule detects attempts to create a remote named pipe over SMB (Server Message Block) protocol. It specifically looks for TCP traffic directed to port 445 (SMB) on the home network, containing both the SMB signature (FF SMB) and the string "\pipe\" (case-insensitive), indicating an attempt to access or create a named pipe. This activity is often associated with inter-process communication, which can be leveraged by attackers for various purposes, including lateral movement, service execution, or privilege escalation.
This rule detects a high volume of Inter-Process Communication (IPC) activity targeting the RPC Endpoint Mapper on the home network. Specifically, it triggers an alert if more than 30 TCP connections to port 135 (RPC Endpoint Mapper) are observed from a single source IP within a 10-second window. This could indicate an attempt to enumerate services or exploit vulnerabilities related to RPC.
Detects when a 7-Zip process, potentially running from a user directory, writes a file to a sensitive system location. This could indicate a directory traversal attack (e.g., CVE-2025-11001, CVE-2025-11002) where a malicious archive writes a file outside of the intended extraction path. The rule specifically looks for 7-Zip processes initiated from common user-land folders (like Downloads, Desktop, Documents, Temp) creating files in sensitive system directories (like C:\Windows, C:\Windows\System32, C:\ProgramData, or Startup folders), while excluding legitimate installations to Program Files.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
KQL Query
KQL Query from file: CVE-2025-29824 PipeMagic Detection
Detects Trickbot malware process tree pattern in which "rundll32.exe" is a parent of "wermgr.exe"
This query finds network communication to specific URL.
Please note that in line #7 it filters RemoteUrl using has operator, which looks for a "whole term" and runs faster.
Example: RemoteUrl has "microsoft" matches "www.microsoft.com" but not "microsoftonline.com".
Please note that in line #7 it filters RemoteUrl using has operator, which looks for a "whole term" and runs faster.
Example: RemoteUrl has "microsoft" matches "www.microsoft.com" but not "microsoftonline.com".
This rule detects the launch of web browsers (both Chromium-based and Firefox) with command-line arguments that enable remote debugging. This functionality, while legitimate for developers, can be abused by attackers to inject malicious code, steal credentials, or perform browser session hijacking. The rule specifically looks for '--remote-debugging-' in Chromium-based browsers and '-start-debugger-server' in Firefox.
This analytic detects suspicious activity involving named pipes, specifically focusing on processes known to be abused by Qakbot. It identifies the creation or connection to randomly generated named pipes in GUID format, which is a characteristic behavior of Qakbot malware for inter-process communication after code injection. This activity is indicative of a potential Qakbot infection, which could lead to unauthorized data access and exfiltration.
This analytic detects processes with command lines containing named pipes. This behavior is often used by adversaries for inter-process communication post-injection, aiding in defense evasion and privilege escalation. The rule specifically excludes processes originating from common program file paths to reduce false positives. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.
Page 2 of 2