Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
This rule detects two suspicious patterns: 1) DLL sideloading of 'libcef.dll' by processes like 'ClaudeDesktop.exe' or JetBrains-related tools when executed from non-standard directories like 'Downloads', 'Temp', or 'AppData'. 2) Unauthorized access to common browser credential storage files (e.g., 'Login Data', 'Cookies') by processes other than standard browsers.
Detects a DLL created or modified directly under C:\Windows\System32 that is then loaded into a process within 30 minutes of its creation. This creation-to-load temporal correlation is a durable indicator of a dropped-and-loaded malicious module (as used by the HardBreacher/SolidSnake exploit chain), independent of the DLL's filename. Signer/trust correlation intentionally omitted (DeviceFileCertificateInfo not part of this environment's ingested telemetry).
This rule monitors for indicators of compromise (IOCs) and behavioral patterns associated with the Lazarus Group's 'Operation Dream Job' campaign. It tracks known malicious hashes, domains, and IP addresses, alongside suspicious activities such as PDF viewer abuse, DLL side-loading, process injection, persistence mechanism creation (Registry/Scheduled Tasks), and recruitment-themed phishing lures.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
Detects when the PostgreSQL service process (postgres.exe/postgres/postmaster) loads a shared library (.dll or .so) from a non-standard, user-writable directory (e.g., Temp, AppData, /tmp). This behavior is indicative of potential exploitation of vulnerabilities like CVE-2026-6471, where attackers attempt to load malicious plugins via unvalidated logical decoding plugin paths.
This rule detects potential reflective code injection or in-memory loading (fileless) where a DLL or PE image is loaded by mshta.exe or powershell.exe, but the module load event lacks a valid file path on disk (or indicates a device path). This behavior is often associated with the execution of malicious payloads such as the Amatera loader, where payloads are executed directly in memory to evade file-based security detections.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects instances where a Python interpreter (python.exe or pythonw.exe) loads the 'snap7.dll' library. This library is commonly associated with the 'python-snap7' package, used for communicating with Siemens S7 PLC devices. This behavior is potentially suspicious in OT environments where Python should not be interacting with industrial control system hardware.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.
This rule detects instances where a process loads 'offreg.dll' (Offline Registry Library) and concurrently accesses the SAM (Security Account Manager) file. This is a common technique used by attackers to offline-extract local account hashes without using standard registry tools, potentially bypassing basic monitoring of 'reg.exe'.
Detects when the PostgreSQL service process (postgres.exe/postgres/postmaster) loads a shared library (.dll or .so) from a non-standard, user-writable directory (e.g., Temp, AppData, /tmp). This behavior is indicative of potential exploitation of vulnerabilities like CVE-2026-6471, where attackers attempt to load malicious plugins via unvalidated logical decoding plugin paths.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Page 16 of 56