Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects the loading of known TELEPUZ-specific DLLs into common Windows host processes (rundll32.exe and svchost.exe). TELEPUZ is known to perform ETW (Event Tracing for Windows) tampering by patching ntdll.dll functions during initialization, which is a technique used to suppress security telemetry.
Detects the loading of amsi.dll by rundll32.exe when invoked with specific command-line arguments. This pattern is associated with the TELEPUZ malware, which leverages this technique to patch the AmsiScanBuffer function in memory, effectively disabling AMSI (Antimalware Scan Interface) scanning for the process.
Detects the loading of a malicious DLL into the msiexec.exe process that exhibits characteristic Rust/Tokio async-runtime initialization behavior. This includes exported function names like 'RUN' and specific interactions with the 'TOKIO_WORKER_THREADS' environment variable or API calls to 'GetSystemInfo' and 'CreateThread' to size the worker thread pool. This behavior is associated with msaRAT, where the DLL is loaded via MSI custom actions to run within the context of the Windows Installer service.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the HelloNet campaign's persistence technique in which itcsrvup64.exe (ViPNet Update System, part of ViPNet Client) sideloads a malicious wtsapi32.dll from the ViPNet Update System directory to execute a payload at OS startup.
Detects instances where the executable 'pcl2bmp.exe' loads the DLL 'ctxmui.dll' from its own local directory. This behavior is indicative of potential DLL side-loading, where a legitimate application is used to load a malicious library by placing it in the same directory as the executable to influence the DLL search order.
Detects the loading of a DLL named 'SolidPDFCreator.dll' where the initiating process claims to be 'Solid PDF Creator', but the loaded DLL is not digitally signed. This behavior is indicative of potential DLL hijacking or masquerading where an unsigned malicious file is substituted for a legitimate application component.
Detects the 'beast.exe' process loading the 'RstrtMgr.dll' library. This behavior may be indicative of DLL side-loading, hijacking, or the execution of potentially malicious code masquerading as or interacting with system libraries.
Detects the loading of a potentially malicious DLL (WinUpdateHelper.dll) by a process masquerading as or identified as a GTA 5 Online mod menu. This behavior is indicative of DLL injection or side-loading techniques used by gaming cheats/malware to maintain execution context.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the loading of 'bindfltapi.dll' or 'bindlink.dll' by processes other than known legitimate system or container management services. These DLLs are associated with Bind-Link Management, and their loading by unexpected processes could indicate potential DLL hijacking or unauthorized abuse of these modules.
Detects instances where two specific DLL files, 'wwide9.dll' and 'FcHand.dll', are loaded by the same process on a device. This pattern of concurrent loading may indicate the execution or injection of malicious components, as these specific filenames are often associated with threat actor activity or malware campaigns.
Detects a process that simultaneously loads 'RstrtMgr.dll' and modifies the 'WaitToKillServiceTimeout' registry value within a 2-minute window. This behavior is indicative of an adversary attempting to force system service restarts or accelerate service termination, often seen as part of persistence mechanisms or defensive impairment.
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Detects the LabubaRAT implant (nvidia-sysruntime.exe) loading gdi32.dll, consistent with its screenshot capture routine which uses GetDC, CreateCompatibleBitmap, BitBlt (SRCCOPY), and GetDIBits to capture the desktop and return a base64-encoded JPEG to the attacker.
Detects the Snowlight dropper (wusvc.exe) attempting to evade analysis by loading 'verifier.dll' to perform anti-debugging checks. This technique, associated with UNC5221 activity, involves inspecting the process environment and debugger-related messages to detect the presence of debugging tools.
Detects the loading of 'abe_decrypt.dll' into Google Chrome or Microsoft Edge browser processes. This behavior is highly irregular and often associated with browser-based malware, credential theft, or injection attempts to intercept browser data.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
This rule detects when specific legitimate-looking executables (BDSubWiz.exe, VSTestVideoRecorder.exe, GoogleDesktop.exe) initiate a module load from high-risk, world-writable directories such as '\Users\Public\', '\AppData\Local\Temp\', or '\Windows\Temp\'. This pattern is highly characteristic of DLL side-loading or masquerading, where an adversary uses a known benign process to load malicious code.
Page 20 of 56