Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects anomalous process injection behavior characteristic of the Turb00 operation (e.g., Go-loader/HijackLoader variants). The rule identifies a two-stage signal: first, the mapping of an unbacked or unusually named executable image into a process before the loading of ntdll.dll; and second, the subsequent invocation of sensitive process manipulation APIs like CreateRemoteThread or SetThreadContext on the same host within a 10-minute window, consistent with process hollowing.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects DLL sideloading and suspicious module loading by legitimate signed executables from user-writable directories (e.g., AppData, Temp). This covers known techniques used in campaigns like TA4922, targeting executables such as AnyDesk and vulkaninfo.exe to load unauthorized DLLs.
Detects attempts by malicious processes to disable AMSI (Antimalware Scan Interface) by memory-patching the AmsiOpenSession function. The rule monitors processes loading amsi.dll that match known loaders used by DcRAT malware, which use VirtualProtect to alter memory segments in order to bypass security scans of .NET payloads.
Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.
Detects instances where the specific DLL 'n-ten.dll' is loaded by a process on a device that has experienced five or more failed network logon attempts within a one-hour window. This behavior potentially indicates an adversary attempting to gain access to a host via credential brute force followed by the execution of a custom or malicious library.
Detects the macOS 'Finder' process loading 'ServiceManagement.framework' from a non-standard path within '/Library/Application Support/'. This behavior is highly suspicious as Finder should typically load system frameworks from standard paths, and unexpected module loading in this context may indicate code injection, tampering, or malicious activity disguised as part of the operating system.
Detects DLL sideloading behavior where a legitimate, signed executable (e.g., in System32 or Program Files) loads a DLL from a non-standard, user-writable directory (e.g., Temp, AppData, Downloads). This pattern is consistent with the delivery of Obsidian Sandstorm (Storm-2571) payloads such as ThrottleDrift, RiverGorilla, and SilverGorilla, where malicious DLLs are staged and loaded alongside trusted binaries.
Detects execution of potential BeepRAT loaders such as tcc.exe, luajit.exe, or hfy.exe that exhibit evasive behavior by loading amsi.dll. This activity is indicative of in-memory shellcode execution attempting to disable security features like AMSI, ETW, or WLDP before loading malicious payloads.
Detects DLL side-loading activity associated with the Kazuar backdoor, where legitimate executables (LaunchGFExperience.exe or vncutil64.exe) are executed from unusual directories (Brother Printer or Sony Audio drivers) to load a malicious DLL (LaunchGFExperienceLOC.dll).
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
This rule detects the legitimate Windows filter manager utility, fltMC.exe, performing suspicious activities when launched from temporary directories. It specifically flags cases where fltMC.exe loads modules without a corresponding file path (indicative of reflective DLL injection) or initiates sensitive memory allocation APIs (such as VirtualAllocEx or CreateRemoteThread) that are commonly associated with process hollowing or code injection.
Detects instances where 'Mixed Reality.exe' or 'wmplayer.exe' load DLLs from suspicious directories such as AppData, Temp, or ProgramData, specifically when the loading process or the loaded DLL appears unsigned or lacks verification by Microsoft. This behavior is indicative of potential DLL sideloading or hijacking, where adversaries leverage trusted applications to execute malicious code.
Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.
Detects DLL sideloading activity where legitimate, signed binaries such as ADNotificationManager.exe or QEMU-related executables (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe) load malicious DLLs (e.g., vcruntime140_1.dll) from user-writable directories (e.g., AppData, Temp, ProgramData). This behavior is associated with the GOLD ENCOUNTER and STAC campaigns for delivering payloads like Havoc C2.
This rule detects when the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library from a file path outside of the standard, expected directories (such as Windows Defender or System32 folders). This behavior is often indicative of potential DLL side-loading, where an attacker attempts to substitute a legitimate system DLL with a malicious version to execute code in the context of a trusted Microsoft process.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects the loading of DLLs by rundll32.exe from non-standard user-writable directories (AppData, Temp), often associated with infostealer clipper plugins such as clip64.dll. These patterns are commonly used by malware families like Amadey, LokiBot, and Lumma Stealer to maintain persistence or execute malicious functionality via legitimate Windows binaries.
This rule detects when a signed process loads a DLL file from common user-writable directories (AppData, ProgramData, Public, Downloads). It further filters by verifying that the DLL is located in the same directory path tier as the executing process, which is a common indicator of side-loading or DLL hijacking activity where an attacker places a malicious DLL alongside a legitimate executable.
Detects the execution of specific suspicious processes (Mixed Reality.exe, COU_ITR-1_to_4_AY2026-27.exe) or svchost.exe processes spawned from Windows Media Player paths, followed by suspicious loading of amsi.dll. This behavior is associated with the DragonReturn DLL sideloading and evasion chain.
Page 22 of 56