Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects DLL sideloading behavior where a process named defender.exe, located in a directory mimicking the Windows Defender installation path, loads specific DLLs (libngs.dll or libsrapc.dll) associated with the HoneyMyte actor's CoolClient malware.
This rule detects potential DLL sideloading by monitoring SumatraPDF.exe (SmartaPDF.exe) for the loading of a library named 'libmupdf.dll' from a non-standard or user-writable location. It combines process image load events with file activity patterns related to SumatraPDF cache and settings files, which are common indicators of malicious activity associated with this binary.
Detects the presence of Afd4Eop12_x64.dll or the execution of command lines referencing specific exploit indicators such as 'initialize_afd_npfs_exploit' or 'enable_god_mode', often associated with local privilege escalation exploits leveraging kernel vulnerabilities.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
This rule monitors for suspicious activity involving the OneDrive directory, specifically the file 'wtsapi32.dll'. It triggers when this DLL file is created, modified, or renamed within the OneDrive folder, followed by the termination of the OneDrive process, and subsequent loading of the same DLL file by that process. This pattern is indicative of a DLL side-loading attack where a legitimate application (OneDrive) is used to load a malicious DLL.
Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.
Detects instances where 'ERAAgent.exe', part of the ESET Remote Administrator agent, loads the 'dpapi.dll' library from a location outside of standard Windows System directories (System32 or SysWOW64). Furthermore, the rule flags this behavior if the loaded 'dpapi.dll' file is either unsigned or contains an untrusted digital signature, which may indicate a malicious DLL side-loading or masquerading attempt to access protected system credentials.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
Detects the ESET Remote Administrator (ERAAgent.exe) process loading the 'dpapisvc.dll' module. This behavior is indicative of potential DLL side-loading where an attacker places a malicious DLL with the same name as a legitimate system library in the agent's directory to achieve code execution.
Detects the image load of VSS DLL by uncommon executables
Detects the image load of VSS DLL by uncommon executables
Detects instances where the Windows spooler driver (winspool.drv) is loaded by a process that subsequently performs suspicious memory operations typical of process injection (e.g., CreateRemoteThreadApiCall, WriteToProcessMemory, ProcessInjection) within a 5-minute window.
Detects instances where the legitimate Windows consent.exe process loads the library 'msimg32.dll' from a non-standard system directory, specifically targeting suspicious paths such as user-writable AppData or application installation folders. This behavior is indicative of DLL side-loading, where an attacker places a malicious DLL with the same name as a legitimate library to achieve arbitrary code execution under the context of the trusted consent.exe process.
Detects execution of msiexec.exe involving specific command-line arguments (CA_Run_EA2AEBC3, Bin_lib_EA2AEBC3) often associated with malicious installers or library side-loading, correlated with the loading of 'lib.dll' by the msiexec process.
Detects module or image load events where the image lacks an associated on-disk path (FolderPath is empty). This behavior is indicative of in-memory code loading, such as reflective loading or the execution of Beacon Object Files (BOFs), where malicious code is mapped directly into process memory rather than loaded via the standard OS image loader.
This rule detects the loading of kernel-mode drivers that match hashes identified as vulnerable or malicious by the LOLDrivers project. This is a common indicator of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, where adversaries exploit legitimate, signed drivers with known vulnerabilities to gain kernel-mode code execution or elevate privileges.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
This rule detects potential persistence or privilege escalation attempts using Windows Print Monitors. It identifies two specific behaviors: the registry modification of the Print Monitors key to load a DLL from a non-standard, user-writable directory (e.g., ProgramData or Users) which is subsequently loaded by the print spooler service (spoolsv.exe), and suspicious registry activity occurring immediately prior to such modifications, specifically involving non-system accounts or vendor-specific services writing to HKLM registry paths.
This rule detects potentially unauthorized processes loading sensitive Windows authentication-related DLLs, specifically those associated with Microsoft Entra ID (formerly Azure AD) and Windows Hello functionality. By filtering against a list of known, legitimate processes, the rule identifies non-Microsoft signed processes that may be attempting to interact with authentication modules, which is a common pattern in credential theft or token manipulation attacks.
Detects potentially suspicious loading of the Offline Registry Library (offreg.dll).
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
Offreg.dll enables direct read/write access to offline registry hives without invoking the Windows Registry API,
bypassing its associated audit logging and telemetry. Attackers may abuse this to stealthily modify registry hives
while evading detection mechanisms that rely on standard registry event logs.
This rule detects potentially unauthorized processes loading sensitive Windows authentication-related DLLs, specifically those associated with Microsoft Entra ID (formerly Azure AD) and Windows Hello functionality. By filtering against a list of known, legitimate processes, the rule identifies non-Microsoft signed processes that may be attempting to interact with authentication modules, which is a common pattern in credential theft or token manipulation attacks.
Page 18 of 56