Detection library
Every rule here is written against a technique page on this wiki and tested in the lab kit. Sigma and YARA sources are in one repo — import the whole pack or cherry-pick.
Flags a remote thread whose start address has no backing module, inside a Microsoft-signed process.
Matches the classic bootstrap prologue that walks the export table by hash before mapping itself.
Catches loaders that stage with RW and only mark executable immediately before the jump.
Correlates a file read of ntdll.dll with a self-process write into its own text section.
Structural artifact left by every hollowing variant; the highest-fidelity signal in the pack.
Matches the queued RtlCaptureContext + NtContinue gadget sequence used by timer-based sleep masks.
ETW-TI thread-create events whose start address falls outside any mapped image in the target.
Registry write adding a TreatAs subkey under a CLSID owned by a shipped Windows component.
no rules of that kind yet.
title: Unbacked Executable Memory In Signed Host
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartModule: null
TargetImage|endswith: ['\svchost.exe', '\rundll32.exe']
condition: selection
level: hightitle: Unbacked Executable Memory In Signed Host
logsource:
product: windows
category: create_remote_thread
detection:
selection:
StartModule: null
TargetImage|endswith: ['\svchost.exe', '\rundll32.exe']
condition: selection
level: high