Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects the Windows UAC consent.exe process loading msimg32.dll from a non-standard, potentially user-writable location, a technique associated with BumbleBee malware campaigns for DLL sideloading. The rule further inspects the parent process context to ensure consent.exe was launched by an expected parent (svchost.exe) and validates the DLL's signature.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically focusing on DLL side-loading from user-writable directories (AppData, Temp, Downloads) and the execution of randomized executables spawned by wscript.exe, which is characteristic of its VBS dropper mechanism.
Detects instances where common Windows processes (explorer.exe, svchost.exe, dllhost.exe) load an unsigned module (DLL) from user-writable directories, such as AppData, Downloads, or Temp folders. This behavior is a common indicator of potential DLL sideloading or malicious code execution originating from user-controlled space.
Detects instances where explorer.exe loads a DLL file from within C:\ProgramData. This behavior is often associated with adversary activity attempting to hide malicious modules in directories that may have permissive write access or are excluded from routine scans, including techniques used by Covenant frameworks or C2 agents.
This rule detects the creation and loading of the 'NSecKrnl.sys' driver file on a system. The filename is associated with potentially malicious or unauthorized kernel-level activity, often indicative of rootkit behavior or unauthorized persistence mechanisms.
This rule detects the creation and loading of the 'NSecKrnl.sys' driver file on a system. The filename is associated with potentially malicious or unauthorized kernel-level activity, often indicative of rootkit behavior or unauthorized persistence mechanisms.
This rule detects the loading of ntdll.dll by processes executing from common temporary locations (e.g., _MEI* subdirectories used by PyInstaller or .cache/winupdate.exe). Such patterns are frequently associated with the execution of packed or obfuscated malicious payloads, often seen in droppers and loaders that unpack their contents to temporary paths before execution.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
Detects potential DLL side-loading activity associated with TA4922 RomulusLoader, where an unsigned or invalidly signed DLL is loaded by an application from a user-writable directory. This behavior often indicates an attempt to hijack the DLL search order by placing a malicious DLL in a directory commonly used for non-privileged execution.
This rule detects DLL loading events where specific legitimate applications (Adobe Creative Cloud, Microsoft Edge, or Opera GX) load a DLL from their own directory where the DLL file is unsigned or has an invalid digital signature. This pattern is often indicative of DLL sideloading, where an attacker places a malicious DLL in the application's folder to be loaded by the legitimate process.
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.
Detects specific DLL sideloading patterns associated with the OceanLotus (APT32) group, specifically involving the SPECTRALVIPER loader. The rule monitors for known masqueraded binaries (e.g., intelaudioservice.exe, genuine.exe) loading suspicious files or executing with specific command-line arguments (e.g., -uiDll, /appmodel) indicative of malicious sideloading and persistence mechanisms.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.
Detects the suspicious execution of fltMC.exe or the loading of FLTLIB.dll from temporary directories, which is a known behavior of JFMBackdoor malware. It also detects known SHA256 hashes associated with this threat.
This rule detects scenarios where an application located in Program Files or Program Files (x86) loads an unsigned DLL from its own installation directory. It further correlates this activity by checking if the DLL was recently created (within 48 hours) to identify potentially suspicious new files, which may indicate DLL hijacking or side-loading attempts.
This rule detects processes that load .NET-related modules (clr.dll or dotnet.exe) and maintain a network connection (port 80 or 443) for more than one hour during standard business hours. This behavior is indicative of potentially persistent, long-running .NET-based applications or potentially malicious tools maintaining persistence and C2 communication.
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
Page 26 of 56