Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects the NightLedger backdoor's screenshot capture routine (C2 Command ID 36) executing within its sideloaded/hijacked host process AppVShNotify.exe, evidenced by the process loading the GDI graphics module used to capture the victim desktop. Excludes GDI loads from the legitimate Microsoft Application Virtualization Client installation path to focus on the rogue/hijacked process context.
Detects loading of the GDI screen-capture library (gdi32full.dll/gdi32.dll) specifically within the AppVShNotify.exe process, which is hijacked/sideloaded by NightLedger to implement Command ID 36 ("take a screenshot") visual reconnaissance capability. Scoping to the rogue AppVShNotify.exe process context (rather than any process loading GDI screenshot APIs) reduces false positives from legitimate remote-access and screenshot utilities that commonly use these APIs. Excludes legitimate AppVShNotify.exe executing from the standard Microsoft Application Virtualization Client install path.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects the NightLedger DLL search-order hijacking technique where a malicious SspiCli.dll is loaded by the legitimate process AppVShNotify.exe. This rule triggers when SspiCli.dll is loaded from a directory other than the standard Windows System32 or SysWOW64 directories.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects DLL sideloading of 'version.dll' by a signed 'OneDrive.exe' process where the DLL was created via 'WriteFile' (indicating direct write rather than browser download) and lacks a 'Zone.Identifier' (Mark-of-the-Web). This combination is characteristic of evasion techniques found in toolkits like Dolphin X Agent Builder to bypass SmartScreen and initial execution defenses.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects the loading of 'tempdir.dll', a module identified as implementing an anti-VM/sandbox gate. This mechanism queries DXGI adapter vendor IDs (e.g., QEMU 0x1234, VMware 0x15AD), checks for low VRAM allocation, and performs compute shader timing analysis to detect virtualization or sandbox environments prior to secondary payload execution.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects the loading of 'lib.dll' by the 'msiexec.exe' process. This behavior is atypical and may indicate DLL hijacking or sideloading where a malicious library is loaded by the Windows Installer process.
Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Page 19 of 56