Detection library
Every rule here is written against a technique page on this wiki and tested in the lab kit. Sigma and YARA sources are in one repo — import the whole pack or cherry-pick.
Flags a remote thread whose start address has no backing module, inside a Microsoft-signed process.
Matches the classic bootstrap prologue that walks the export table by hash before mapping itself.
Catches loaders that stage with RW and only mark executable immediately before the jump.
Correlates a file read of ntdll.dll with a self-process write into its own text section.
Structural artifact left by every hollowing variant; the highest-fidelity signal in the pack.
Matches the queued RtlCaptureContext + NtContinue gadget sequence used by timer-based sleep masks.
ETW-TI thread-create events whose start address falls outside any mapped image in the target.
Registry write adding a TreatAs subkey under a CLSID owned by a shipped Windows component.
A TGS request (4769) or network logon (4624) for an account whose TGT was never issued interactively on the presenting host.
A Kerberos service logon whose TGS has no matching 4769 on the domain controller - the ticket was forged, not issued.
A 4768 with RC4-HMAC (0x12) pre-auth etype for an account with no recent interactive logon - an NT hash drove the request.
A committed region holding a PE at a non-preferred base (relocations applied) with no EID 7 image-load event for it.
Matches shellcode that carries an MZ header plus relocation and import-fixup code ahead of an entry jump.
A file or .lnk created in a per-user or common Startup directory by a non-explorer parent process.
A registry write to HKLM ... Winlogon Userinit or Shell that is not the stock userinit.exe path.
A single client issuing a repeating BindRequest + SearchRequest sequence of constant size against an LDAP endpoint.
A fresh process issuing CIM queries for Processor, ComputerSystem, DiskDrive and NetworkAdapter before any file or network IO.
A non-system process opens or copies SAM, SYSTEM or SECURITY from the Windows system config directory.
An NTLM authentication from a workstation to a host outside the SMB or WMI baseline, immediately after a name-resolution response.
An auditd or EDR file-open event for a krb5cc credential-cache file by a process that is not kinit, klist or the owning shell.
A 4769 with S4U or delegated flags issued by an account that is not a registered service principal.
A value set to AppInit_DLLs or a new entry created under Image File Execution Options AppCertDlls.
A new subkey under Active Setup Installed Components with a StubPath and IsInstalled set to 0.
Repeated open, read, write and delete cycles against C$ or ADMIN$ tasking files from one account at a constant interval.
no rules of that kind yet.
title: Unbacked Executable Memory In Signed Host
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartModule: null
TargetImage|endswith: ['\svchost.exe', '\rundll32.exe']
condition: selection
level: hightitle: Unbacked Executable Memory In Signed Host
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartModule: null
TargetImage|endswith: ['\svchost.exe', '\rundll32.exe']
condition: selection
level: high