Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects processes located outside of standard Windows system directories (System32 and SysWOW64) that load the advapi32.dll library. Advapi32.dll is a core Windows API library frequently used for security-related functions, including service control and registry manipulation; its loading by non-system binaries can be indicative of masquerading or malicious activity.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.
Detects instances where a legitimately signed executable located in protected system directories (System32, SysWOW64, Program Files) loads a DLL module from common user-writable directories (Temp, AppData, Public, ProgramData). This behavior is characteristic of DLL sideloading, where an adversary leverages a trusted binary to execute malicious code contained in a side-loaded DLL.
This rule detects suspicious activity indicative of virtualization or sandbox evasion. It looks for the loading of 'mpr.dll' in conjunction with specific registry keys related to VirtualBox ('HARDWARE\ACPI\DSDT\VBOX_'). Additionally, it identifies processes executing with command lines containing strings associated with Sandboxie ('sbiedll.dll'), network connection functions ('WNetAddConnection2W'), or queries for video controller information ('SELECT CurrentRefreshRate FROM Win32_VideoController'), which are often used by malware to detect analysis environments. The rule also correlates 'mpr.dll' and 'sbiedll.dll' loads within the same process.
Detects DLL sideloading behavior associated with Operation DragonReturn (Silver Fox), specifically identifying the loading of 'nvdaHelperRemote.dll' by 'Mixed Reality.exe' and the creation of the DLL in the Windows Media Player directory by unauthorized processes.
This rule monitors for processes running from a specific directory under 'AppData\Roaming\traiolx custom utils\' that load critical Windows system libraries ('user32.dll' or 'kernel32.dll'). This behavior is indicative of DLL side-loading or masquerading where an executable in a non-standard, user-writable directory attempts to load core system components, a common tactic used by malware to establish persistence or run malicious code.
This rule detects when known DLL files (7z.dll or normaliz.dll) are loaded by a process from a file path containing 'Traiolx Custom Utils'. This pattern is often indicative of DLL side-loading or hijacking, where an adversary places malicious or proxy DLLs in a custom directory to be loaded by a legitimate application.
This rule detects the loading of specific DLL files (SolidPDFCreator.dll, ctxmui.dll) by suspicious or masquerading process names (pcl2bmp.exe, Project Proposal.exe, Memorandum of Understanding.exe) from common user-writable or temporary directories, which is often indicative of side-loading or execution of malicious components.
Detects the loading of DLL files from user-writable or non-standard directories (e.g., AppData, Temp, ProgramData) that are often used in DLL sideloading attacks to hijack application search order. This rule identifies patterns associated with TRUSTRAP-style activity where a malicious DLL is placed in an adversary-controlled directory to be loaded by a legitimate application.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Detects the HijackLoader malware infection chain where the legitimate, signed Opera executable 'AlphVector.exe' (spawned by 'WizardDa42.exe') loads a malicious version of 'opera_elf.dll'. This process subsequently loads 'WebView2Loader.dll', indicating a multi-stage component loading sequence characteristic of HijackLoader.
This rule detects the suspicious loading of 'msimg32.dll' by 'consent.exe' from non-standard directories, specifically targeting temporary folders often used by the Bumblebee malware loader. This behavior is indicative of DLL side-loading to execute malicious code within the context of a legitimate system process.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
Detects instances where a process named 'install.exe' loads a DLL named 'install.res.1033.dll' from the same directory. This pattern is often associated with software installers or potential masquerading attempts where malicious payloads utilize specific resource DLL naming conventions.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.
This rule detects the loading of suspicious DLL files (commonly associated with MinGW or image processing libraries) from user-writable directories such as AppData or Temp. Loading these libraries from these non-standard locations, particularly when not initiated by a known legitimate process, may indicate DLL side-loading or execution of masqueraded malicious binaries.
Detects Grandoreiro banking trojan activity by identifying the loading of specific DLLs (e.g., mingwm10.dll, libwebp.dll, libffi-6.dll) from non-standard or user-writable directory paths, which is characteristic of the Grandoreiro DLL side-loading technique.
This rule detects the loading of specific DLL files (commonly associated with open-source software libraries like mingw or webp) from user-writable directories (Temp, Downloads, AppData, etc.) by specific processes. The rule further correlates these events with recent execution of potential phishing-related commands (WScript, CScript, or download-related activity) on the same host within a 1-hour window.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Page 27 of 56