Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects instances where 'db.dll' is loaded by a process, followed closely by outbound network activity from processes typically associated with disk analysis tools like WinDirStat or suspected DLL hijacking patterns using uxtheme.dll. This behavior often suggests the presence of a malicious payload or credential harvesting module being used to interact with remote databases.
Detects the loading of DLLs by signed processes from suspicious, user-writable, or known staging directories associated with malware loaders like HijackLoader. The rule monitors for module load events involving paths such as AppData, ProgramData, and user profile subdirectories, while excluding known legitimate publishers and paths.
This rule detects suspicious activity associated with the Cavern Manticore threat group, specifically the loading of the 'mhm.dll' module followed by the creation of archive files (.zip, .rar, .7z) within one hour by the same process. This behavior is indicative of data staging for exfiltration, potentially involving DPAPI-protected data.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
Detects the Finder application on macOS loading authentication modules (libpam.dylib) from within the 'Application Support' directory. The rule further correlates this by checking if common system utility tools (dscl, security, osascript) were initiated by the same Finder process path, flagging cases where legitimate system activity is absent, which may indicate potential dylib hijacking or suspicious process behavior.
Detects DLL side-loading attempts and suspicious process executions associated with the HijackLoader (wingo) malware distribution chain. The rule monitors for specific common applications loading known vulnerable DLLs from suspicious non-standard directories (e.g., ProgramData, Temp) and tracks rare parent-child process relationships associated with this campaign.
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Detects potential local privilege escalation attempts leveraging the AnyDesk printer named pipe (adprinterpipe). The rule monitors for the creation of the adprinterpipe, the spawning of processes with SYSTEM privileges from an AnyDesk parent, and the loading of suspicious DLLs by AnyDesk, which are indicative of an exploit leveraging insecure COM unmarshaling callbacks.
This rule detects DLL side-loading attempts by identifying signed processes that load unsigned or invalidly signed DLLs from the same directory as the initiating process, specifically excluding standard system directories (System32, SysWOW64, WinSxS) to reduce noise. This behavior is a common technique used by attackers to execute malicious code under the context of a trusted, legitimate application.
Detects the loading of native DLL modules that follow an 'n-[filename].dll' naming convention. This pattern is commonly observed in reflective DLL loading techniques or specific framework loaders to distinguish these modules from standard .NET DLLs, potentially indicating stealthy code injection or execution within a process.
Detects DLL search-order hijacking where potentially malicious or unauthorized versions of common application DLLs (such as those from Opera or Qt5 framework) are loaded from non-standard locations like %TEMP%, %AppData%, or user-writable directories instead of their legitimate installation paths. This technique is often associated with loaders like HijackLoader/CastleLoader to execute arbitrary code within the context of a legitimate process.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects rapid SMB (port 445) connect/disconnect patterns originating from processes that have loaded mpr.dll. This behavior is indicative of credential spraying tools, such as the Cavern Manticore NetUseBrute module, which utilizes WNetAddConnection2 and WNetCancelConnection2 to cycle through credentials against multiple endpoints.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Detects unauthorized processes attempting to access Firefox credential storage files (key4.db, logins.json) or loading the NSS cryptographic library (nss3.dll) commonly used by Firefox for decryption, which is indicative of credential harvesting.
Detects the presence and execution of components associated with the 'Exploitarium' toolkit, a collection of exploit harnesses and proofs-of-concept. The rule monitors for process execution of specific filenames, file creation events, persistence via registry-based service installation, and image loads related to the toolkit's binaries.
Detects instances where a trusted process (defined by a signed executable) loads a DLL that is either unsigned, untrusted, or signed by a different entity than the parent process. This behavior is commonly associated with DLL hijacking or side-loading attacks originating from suspicious paths such as user profile directories, temporary folders, or public download areas.
Detects instances where the Windows Update Service (wusvc.exe) loads amsi.dll, a behavior associated with the Snowlight dropper to facilitate in-memory patching of AMSI functions (AmsiScanBuffer, AmsiInitialize, and AmsiOpenSession) and bypass security scanning.
Detects the process Crisp.exe creating a legacy AT-style scheduled task job file in the C:\Windows\Tasks directory while simultaneously loading mstask.dll. This behavior is indicative of persistence establishment, specifically associated with the Operation Turb00 HijackLoader sideloading chain which utilizes legacy task scheduling to re-execute AlphVector.exe.
Detects instances where a process located outside of the standard '/System/' or '/usr/' directories loads the 'Security.framework' library. This behavior is suspicious as it may indicate an attempt by an untrusted or malicious binary to hook into or interact with system-level security services, such as keychain or cryptographic APIs.
This rule monitors for the installation or loading of a specific driver file, 'pcdhost.sys', through file creation, registry modifications for services, or image loads. It then correlates this activity with subsequent rapid process termination events on the same host, flagging cases where five or more processes are terminated within a 5-minute window following the driver activity.
Page 21 of 56