Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule detects various methods used to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to extract credentials. It monitors for suspicious Process Access (EventCode 10) with sensitive access masks, as well as Process Creation (EventCode 1) and Image Load (EventCode 7) events associated with known credential dumping tools like Mimikatz and legitimate system tools misused for dumping memory such as Procdump and comsvcs.dll.
This rule detects activities associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the loading of known vulnerable drivers, the installation or configuration of drivers via system services, and the execution of tools known to facilitate driver-based kernel manipulation.
Detects the loading of user32.dll or ntdll.dll by processes running from suspicious, user-writable directories (e.g., AppData, Temp, Public). This pattern is consistent with TA4922 Atlas RAT and other implants attempting to install keyboard hooks for input capture via SetWindowsHookEx or GetAsyncKeyState.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects processes running from suspicious, writable directories (Temp, AppData, Downloads) that simultaneously load the .NET Common Language Runtime (clr.dll) and initiate network connections. This behavior is indicative of a downloaded binary or payload executing managed code to perform C2 communication.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects DLL sideloading patterns associated with OceanLotus (APT32), specifically targeting known sideloaded module filenames or legitimate processes loading modules from user-writable and non-standard directories using suspicious command-line flags.
This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.
Detects DLL side-loading where the signed Tencent UxEnhanceHost binary loads a malicious UxEnhance64.dll from randomized staging directories under C:\Users\Public\, a primary execution vehicle in the SilverFox campaign.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects instances where an executable loads a dynamic-link library (DLL) from its own directory, specifically focusing on files with 'minibrowse' or 'minijunk' in the path. This pattern is commonly used in DLL side-loading or directory-based hijacking to ensure that a malicious library is loaded instead of the intended legitimate library.
Detects instances where legitimate, signed executables (specifically associated with Citrix, VMware, FortiGate, or Microsoft) load an unsigned DLL from the same directory as the executable. This pattern is indicative of DLL side-loading (Search-Order Hijacking), often used by attackers to gain persistence or mask malicious code execution under a trusted process. The rule excludes standard Windows System32/SysWOW64 directories to focus on non-standard, potentially attacker-controlled, file locations.
Detects instances where common Windows processes (explorer.exe, svchost.exe, dllhost.exe) load an unsigned module (DLL) from user-writable directories, such as AppData, Downloads, or Temp folders. This behavior is a common indicator of potential DLL sideloading or malicious code execution originating from user-controlled space.
This rule detects suspicious activity associated with the 'MixedSvc' service and potential DLL side-loading. It identifies the creation of a Windows service named 'MixedSvc' using sc.exe, the execution of 'Mixed Reality.exe' from a Windows Media Player directory, the side-loading of 'nvdaHelperRemote.dll' within the Windows Media Player directory, and the execution of svchost.exe with 'Mixed Reality.exe' as its parent/causality actor, which is indicative of malicious injection and persistence mechanisms.
Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.
Detects the loading of the 'avicap32.dll' library or references to it in command lines by specific processes (hfy.exe, tcc.exe) associated with the BeepRAT malware family, indicating potential unauthorized webcam access.
Detects multiple suspicious activities associated with the AnyDesk remote access application, including the creation of specific named pipes, execution of processes with sensitive command-line arguments (e.g., comsvcs, impersonation privileges), non-standard DLL loads by the application, and the spawning of system-level processes. These behaviors are indicative of abuse of remote access software for post-exploitation activities or privilege escalation.
This rule detects the suspicious loading of gdi32.dll and the execution of BitBlt functions (CreateBitmap or BitBlt) by the process MpExtMs.exe. This pattern is indicative of the Backdoor.Mistic malware, which uses these GDI functions to perform unauthorized screen captures.
Detects the loading of 'nvdaHelperRemote.dll' or 'nvdaHelper64.dll' by any process other than 'nvda.exe', or when loaded from outside the legitimate NVDA installation directory. This pattern is commonly used in DLL sideloading attacks to execute arbitrary code, as observed in Operation DragonReturn.
Detects the loading of amsi.dll by processes running from suspicious or user-writable directories (e.g., Temp, AppData) or common scripting interpreters like Python. This behavior is often indicative of an attempt to tamper with or bypass the Antimalware Scan Interface (AMSI) for malicious purposes.
Detects the loading of unsigned .dll or .ocx modules from non-standard, potentially user-writable directories such as AppData, Temp, or ProgramData. This behavior is frequently associated with persistence mechanisms or side-loading techniques.
Page 23 of 56