Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule monitors for the loading of 'avicap32.dll' by processes that are not typically associated with video or audio conferencing and recording. 'avicap32.dll' is a legacy Windows library used for capturing video, often abused by malware to secretly access webcams for surveillance purposes. By filtering out known legitimate applications (e.g., Zoom, Teams, OBS, Skype), this rule flags potential unauthorized access to video capture capabilities.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects processes running from suspicious, writable directories (Temp, AppData, Downloads) that simultaneously load the .NET Common Language Runtime (clr.dll) and initiate network connections. This behavior is indicative of a downloaded binary or payload executing managed code to perform C2 communication.
This rule monitors for scenarios where a DLL is created and subsequently loaded by a process within a short time frame (60 seconds or less). The rule specifically excludes files located in 'C:\Windows\' and 'C:\Program Files\' to minimize noise, focusing on suspicious modules originating from user-writable or unexpected locations, which is a common behavior of malware or side-loading attacks.
This rule monitors for scenarios where a DLL is created and subsequently loaded by a process within a short time frame (60 seconds or less). The rule specifically excludes files located in 'C:\Windows\' and 'C:\Program Files\' to minimize noise, focusing on suspicious modules originating from user-writable or unexpected locations, which is a common behavior of malware or side-loading attacks.
Detects cross-process memory operations and remote thread creation associated with the SPECTRALVIPER sideloading chain. It specifically flags injections originating from IntelAudioService.exe into OneDrive or svchost processes, the loading of the DtlCrashCatch.dll module, and general suspicious remote thread or memory write operations against these targets, excluding known system processes and security software.
Detects DLL sideloading attempts associated with the Red Lamassu threat activity. The rule monitors for common Windows system binaries (odbcconf.exe, regsvr32.exe, rundll32.exe, and svchost.exe) loading DLL files from user-writable directories such as Temp, Downloads, AppData, and ProgramData, while filtering out legitimate loads from standard system paths.
Detects instances where a process, other than standard browsers or common system applications, loads 'WINHTTP.dll' and subsequently initiates outbound HTTPS connections. This behavior is often indicative of custom malware or specialized tooling, such as the NUKESPED/Kimsuky framework, using direct API calls for command and control (C2) communication to bypass standard application-based network filtering.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects a suspicious sequence of events associated with the Operation DragonReturn DcRAT campaign. The rule monitors for the loading of amsi.dll followed by bcrypt.dll within a 5-minute window by specific processes (e.g., Mixed Reality.exe). This pattern is indicative of an AMSI in-memory bypass via AmsiOpenSession patching, followed by the decryption and loading of a .NET assembly, commonly used to maintain stealth during malware execution.
This rule detects the loading of '7z.dll' or 'normaliz.dll' from locations outside of standard Windows system directories (System32, SysWOW64) or Program Files. It identifies instances where these DLLs are loaded from potentially suspicious paths, such as the user's AppData directory, or where the loaded module is unsigned or carries an invalid digital signature. This pattern is commonly indicative of binary masquerading or side-loading techniques.
This rule detects activities associated with the StrikeShark SharkLoader malware, specifically its attempts to suppress Event Tracing for Windows (ETW) and tamper with event logs. It identifies the use of 'wevtutil.exe' to clear security logs, 'auditpol.exe' to disable audit categories, the loading of specific DLLs ('SyncRes.dat', 'DscCoreR.mui', 'SystemSettings.dll') from suspicious AppData paths, and processes originating from these suspicious AppData paths spawning 'wevtutil.exe' or 'auditpol.exe'.
This rule detects potential DLL side-loading and file staging activity by monitoring for the execution of specific suspicious binaries or the loading of known malicious DLLs from non-standard or staging directories like C:\Users\Public\Documents\ or C:\ProgramData\IDM\logs\. The rule flags activity associated with loaders like SHARDLOADER, ZOHOMURK, and MINIRECON.
Detects components of the StrikeShark campaign, specifically the staging of SharkLoader payloads within specific AppData subdirectories (%APPDATA%\xwreg or %APPDATA%\xgdf) and the sideloading of a rogue SystemSettings.dll by the legitimate SystemSettings.exe process from an unauthorized location.
Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects non-browser processes that load 'clr.dll' (indicating in-process .NET/CLR usage) and are sending large volumes of outbound data to Google API domains (sheets.googleapis.com, oauth2.googleapis.com, googleapis.com). This behavior is consistent with the SHEETCREEP threat actor's use of Google Sheets API for command and control (C2) and data exfiltration.
Detects the SharkLoader 'Perfect DLL Hijacking' technique where SystemSettings.exe loads a malicious DLL from user-writable AppData directories and then manipulates LdrpLoaderLock to spawn a malicious thread. This is identified by SystemSettings.exe loading DLLs from specific AppData subfolders (e.g., xwreg, xgdf) and subsequently creating a remote or local thread.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Page 25 of 56