Process Injection detection rulesT1055

Detects the suspicious file that is created from PoC code against Windows Print Spooler Remote Code Execution Vulnerability CVE-2021-34527 (PrinterNightmare), CVE-2021-1675 .

antivirus

Detects the creation of a named pipe as used by CobaltStrike

windows · pipe_created

Detects the creation of a named pipe matching a pattern used by CobaltStrike Malleable C2 profiles

windows · pipe_created

Detects the use of the Dinject PowerShell cradle based on the specific flags

windows · process_creation

Detects the creation of a named pipe seen used by known APTs or malware.

windows · pipe_created

Detects potential Dridex acitvity via specific process patterns

windows · process_creation

Detects the creation of a named pipe with the hardcoded name "REDSUN". The RedSun exploit tool uses a pipe with this name for synchronisation and command communication between its components during the Cloud Files API + oplock-based AV bypass and privilege escalation chain. RedSun creates the pipe as \\??\pipe\REDSUN. The pipe server listens for the token-duplicated elevated process to connect and respond, completing the privilege escalation from user to SYSTEM. Presence of this pipe name indicates active or recent RedSun execution.

windows · pipe_created

Detects Windows Defender (EventID 1119 - Remediation Action Failed) flagging TieringEngineService.exe dropped in a characteristic RS-{GUID} temporary directory, or the RedSun.exe process itself being present. This covers the staging pattern used by RedSun, a Cloud Files API and opportunistic lock (oplock) based AV bypass/privilege escalation tool. RedSun works as follows: 1. Registers a Cloud Files sync root and creates a Cloud Files placeholder for TieringEngineService.exe under %TEMP%\RS-{GUID}\ 2. The placeholder file carries EICAR test file content (Virus:DOS/EICAR_Test_File) to reliably trigger a Defender scan and remediation attempt 3. Requests a batch oplock (FSCTL_REQUEST_BATCH_OPLOCK) on the placeholder file 4. When Defender attempts to scan/quarantine the file, the oplock triggers - holding the file open 5. During the oplock break window, RedSun swaps the mount point (junction) to redirect \\?\C:\Windows\System32 to the attacker-controlled temp path 6. This races the AV/OS into executing the malicious TieringEngineService.exe with elevated privileges

windows

Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances

windows · image_load

Detects actions that disable Address Space Layout Randomization (ASLR) in Linux, including: - Use of the `personality` syscall with the ADDR_NO_RANDOMIZE flag (0x0040000) - Modification of the /proc/sys/kernel/randomize_va_space file - Execution of the `sysctl` command to set `kernel.randomize_va_space=0` Disabling ASLR is often used by attackers during exploit development or to bypass memory protection mechanisms. A successful use of these methods can reduce the effectiveness of ASLR and make memory corruption attacks more reliable.

linux

Detects the creation of a named pipe with a pattern found in CobaltStrike malleable C2 profiles

windows · pipe_created

Detects a "dllhost" process spawning with no commandline arguments which is very rare to happen and could indicate process injection activity or malware mimicking similar system processes.

windows · process_creation

Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.

windows · image_load

Detects process creation events where the Image field lacks an absolute path, which occurs when the backing file no longer exists on disk at the time of logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.

windows · process_creation

Detects remote thread creation from CACTUSTORCH as described in references.

windows · create_remote_thread

Detects the use of CoercedPotato, a tool for privilege escalation

windows · process_creation

Detects the pattern of a pipe name as used by the hack tool CoercedPotato

windows · pipe_created

Detects the pattern of a pipe name as used by the hack tool EfsPotato

windows · pipe_created

Detects usage of HollowReaper, a process hollowing shellcode launcher used for stealth payload execution through process hollowing. It replaces the memory of a legitimate process with custom shellcode, allowing the attacker to execute payloads under the guise of trusted binaries.

windows · process_creation

Detects the process injection of a LittleCorporal generated Maldoc.

windows · process_access

Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons

windows · create_remote_thread

Detects the execution of installed GuLoader malware on the host. GuLoader is initiating network connections via the rundll32.exe process that is spawned via a browser parent(injected) process.

windows · process_creation

Detects the execution of more.com and vbc.exe in the process tree. This behavior was observed by a set of samples related to Lummac Stealer. The Lummac payload is injected into the vbc.exe process.

windows · process_creation

Detects a process access to verclsid.exe that injects shellcode from a Microsoft Office application / VBA macro

windows · process_access

Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows · process_creation

Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag

windows · process_creation

Detects a network connection that is initiated by the "notepad.exe" process. This might be a sign of process injection from a beacon process or something similar. Notepad rarely initiates a network communication except when printing documents for example.

windows · network_connection

Detects the execution of rundll32 that leads to the invocation of legitimate Windows binaries. The malware Pikabot has been seen to use this technique for process hollowing through hard-coded Windows binaries

windows · process_creation

Detects potential process injection via Microsoft Remote Asssistance (Msra.exe) by looking at suspicious child processes spawned from the aforementioned process. It has been a target used by many threat actors and used for discovery and persistence tactics

windows · process_creation

Detects Base64 encoded Shellcode

windows · ps_script

Detects uncommon processes creating remote threads.

windows · create_remote_thread

Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag

windows · process_creation

Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central. This binary can be abused for DLL injection, arbitrary command and process execution.

windows · process_creation

It is extremely abnormal for svchost.exe to spawn without any CLI arguments and is normally observed when a malicious process spawns the process and injects code into the process memory space.

windows · process_creation

Detects suspicious Windows Error Reporting manager (wermgr.exe) child process

windows · process_creation

Detects suspicious process related to rundll32 based on command line that invokes inline VBScript as seen being used by UNC2452

windows · process_creation

Detects specific process characteristics of Chinese TAIDOOR RAT malware load

windows · process_creation

Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns. This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.

windows · process_creation

This rule detects suspicious files created by Microsoft Sync Center (mobsync)

windows · file_event

Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process

windows · create_remote_thread

Detects suspicious connections from Microsoft Sync Center to non-private IPs.

windows · network_connection

Detects potential DLL injection and execution using "Tracker.exe"

windows · process_creation

Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.

windows · image_load

Detects the injection of code by overwriting the memory map of a Linux process using the "dd" Linux command.

linux · process_creation

Detects when a memory process image does not match the disk image, indicative of process hollowing.

windows · process_tampering

Detects potential shellcode injection as seen used by tools such as Metasploit's migrate and Empire's psinject.

windows · process_access

Detects process creation events that use the Sysnative folder (common for CobaltStrike spawns)

windows · process_creation

Detects remote thread creation in command shell applications, such as "Cmd.EXE" and "PowerShell.EXE". It is a common technique used by malware, such as IcedID, to inject malicious code and execute it within legitimate processes.

windows · create_remote_thread

Detects uncommon processes creating remote threads.

windows · create_remote_thread

Detects uncommon target processes for remote thread creation

windows · create_remote_thread

Detects suspicious spawning of a process under a different user context than the parent process. Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.

windows · process_creation

Detects a suspicious child process of userinit

windows · process_creation

Detects when an executable launches an identical instance of itself, a behavior often used to create a suspended “sacrificial” process for code injection or evasion. Investigate for indicators such as the process being started in suspended mode, rapid parent termination, memory manipulation (e.g., WriteProcessMemory, CreateRemoteThread), or unsigned binaries. Review command-line arguments, process ancestry, and network activity to confirm if this is legitimate behavior or process injection activity.

windows · process_creation

Detects process access request to uncommon target images with a "PROCESS_ALL_ACCESS" access mask.

windows · process_access