Browse Rules

OSSEC process monitoring rules.

OSSEC process monitoring rules.

SQL Server process ID.

SQL Server process ID.

Process Injection From Untrusted Process

This query searches for processes performing remote process injection via multiple API calls related to process injection. It filters out programs that inject into their own process or into a process from the same directory. It then finds suspicious processes based on the global prevalence.

Suspicious Outlook Child Process

Detects a suspicious process spawning from an Outlook process.

Suspicious Outlook Child Process

Detects a suspicious process spawning from an Outlook process.

Suspicious Outlook Child Process

Detects a suspicious process spawning from an Outlook process.

Windows Processes Suspicious Parent Directory

Detect suspicious parent processes of well-known Windows processes

Windows Processes Suspicious Parent Directory

Detect suspicious parent processes of well-known Windows processes

Process Monitor Driver Creation By Non-Sysinternals Binary

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

Suspicious Processes Spawned by WinRM

Detects suspicious processes including shells spawnd from WinRM host process

Windows Processes Suspicious Parent Directory

Detect suspicious parent processes of well-known Windows processes

Suspicious Processes Spawned by WinRM

Detects suspicious processes including shells spawnd from WinRM host process

Process Monitor Driver Creation By Non-Sysinternals Binary

Detects creation of the Process Monitor driver by processes other than Process Monitor (procmon) itself.

[WINDOWS-SECURITY] Parent process in the Downloads directory started a process

[WINDOWS-SECURITY] Parent process in the Downloads directory started a process

Abused Debug Privilege by Arbitrary Parent Processes

Detection of unusual child processes by different system processes

Suspicious Process Discovery With Get-Process

Get the processes that are running on the local computer.

Suspicious Processes Spawned by WinRM

Detects suspicious processes including shells spawnd from WinRM host process

Abused Debug Privilege by Arbitrary Parent Processes

Detection of unusual child processes by different system processes

Suspicious Process Discovery With Get-Process

Get the processes that are running on the local computer.

create_process [capabilities]

Create a new process

HackTool - Generic Process Access

Detects process access requests from hacktool processes based on their default image name

Abused Debug Privilege by Arbitrary Parent Processes

Detection of unusual child processes by different system processes

Suspicious HWP Sub Processes

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation

HackTool - Generic Process Access

Detects process access requests from hacktool processes based on their default image name

Suspicious HWP Sub Processes

Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation