Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule monitors for a combination of suspicious behaviors including C2 network activity to known malicious IPs, potential credential theft targeting browser data files, suspicious library loading (such as keyloggers or potential sideloading) from temp or appdata directories, and beaconing activity using non-standard or suspicious processes. The rule calculates a risk score based on the number and type of indicators observed on a single host.
This rule detects DLL loading events where specific legitimate applications (Adobe Creative Cloud, Microsoft Edge, or Opera GX) load a DLL from their own directory where the DLL file is unsigned or has an invalid digital signature. This pattern is often indicative of DLL sideloading, where an attacker places a malicious DLL in the application's folder to be loaded by the legitimate process.
This rule monitors for potential DLL sideloading by detecting specific known executable names loading suspicious modules such as 'dtlcrashcatch.dll' or 'setupui.dll'. It further validates the suspicion by analyzing command-line arguments for sideloading indicators (e.g., '-uidll', '/appmodel') or high-entropy arguments, and checking if the loaded module resides in the same directory as the host process, which is a common pattern for DLL sideloading.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects the AlphVector executable loading specific DLL modules (opera_elf.dll or WebView2Loader.dll) from a suspicious directory (C:\ProgramData\service\), which is a characteristic behavior of DLL side-loading to bypass security controls.
Detects a signed host process (VirtualAr.exe, NeuroManag.exe) loading a .tmp file as an executable image. This behavior is indicative of a process-hollowing variant where a malicious payload is mapped directly into memory from a cached, non-flushed temporary file, a technique observed in campaigns like Operation Turb00 involving Vidar infostealer.
Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.
Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.
Detects the loading of the 'nvdaHelperRemote.dll' library by potentially unauthorized or suspicious executable processes, including 'Mixed Reality.exe' and 'COU_ITR-1_to_4_AY2026-27.exe', or when it is loaded from an unexpected path such as a Windows Media Player directory. This pattern is indicative of DLL side-loading or masquerading techniques.
Detects potential DLL sideloading activities where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver components load dynamic link libraries (DLLs) from non-standard or user-writable directory paths (e.g., Temp, AppData, Downloads). This behavior is characteristic of delivery chains associated with threat actor Mustang Panda, specifically utilizing loaders like SHARDLOADER or MINIRECON.
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects the execution of the Snowlight dropper (wusvc.exe) and its associated module-load events. The rule identifies attempts to load core Windows modules (ntdll.dll, kernel32.dll, kernelbase.dll) by a process name that does not correspond to any legitimate Windows system component, which is indicative of manual PEB (Process Environment Block) module-list walking and dynamic API function resolution used to evade static analysis.
Detects instances where 'MpClient.dll', a legitimate Microsoft Defender component, is loaded by a process that is not a known, trusted Microsoft Defender executable. This behavior can indicate an attempt to abuse Defender's scanning or cleaning APIs for malicious purposes, as seen in 'RoguePlanet' style attacks.
Detects the Windows Update service (wusvc.exe) loading the advapi32.dll library. While advapi32.dll is a standard Windows component, unauthorized or unexpected library loading by system processes can be an indicator of DLL side-loading, process injection, or other hijacking techniques used to execute malicious code within a trusted context.
Detects the Grixba infostealer (associated with Play ransomware operations) by identifying the loading of the XOR-encrypted payload 'inf_g.dll' from commonly abused directories like Temp, AppData, ProgramData, or the Public folder, particularly when the file is unsigned.
Detects the Bumblebee loader technique where the Windows UAC consent UI (consent.exe) loads a malicious msimg32.dll from a non-standard, user-controlled path (such as a temporary directory created by a trojanized MSI installer) instead of the legitimate Windows system directory.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
This rule detects potential local privilege escalation attempts targeting the AnyDesk service. An attacker can exploit the insecure permissions of the 'adprinterpipe' named pipe created by the AnyDesk service to impersonate a client and execute arbitrary commands with NT AUTHORITY\SYSTEM privileges. The rule monitors for suspicious process creation, COM registration changes, anomalous pipe connections, and suspicious DLL loads stemming from AnyDesk processes.
This rule detects potential DLL sideloading activity associated with the SHARDLOADER implant, commonly linked to the threat actor Mustang Panda. It monitors for suspicious executable names (e.g., Project Proposal.exe) loading malicious DLLs (SolidPDFCreator.dll, ctxmui.dll) or interacting with specific staging directories in ProgramData or User Public folders, typical of their TTPs targeting government and energy sectors.
Detects DLL sideloading behavior where the legitimate Citrix Receiver executable 'pcl2bmp.exe' loads the malicious library 'ctxmui.dll' from common staging directories like 'C:\Users\Public\Documents\' or 'C:\ProgramData\Citrix\'. This activity is characteristic of the ZOHOMURK implant deployment attributed to Mustang Panda.
Page 24 of 56