Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.
Detects the loading of DLLs with suspicious names ('hook.dll', 'inject.dll', 'logger.dll', 'loader.dll') from common user-writable directories such as 'Temp', 'AppData', or 'Downloads'. These patterns are frequently associated with malware loaders, persistence mechanisms, or unauthorized code injection attempts.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
Detects SystemSettings.exe running from user-writable AppData or ProgramData directories, or SystemSettings.dll being loaded by SystemSettings.exe from these locations. This behavior is indicative of SharkLoader DLL sideloading, often used as a first stage in attacks.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
This rule detects when the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library from a file path outside of the standard, expected directories (such as Windows Defender or System32 folders). This behavior is often indicative of potential DLL side-loading, where an attacker attempts to substitute a legitimate system DLL with a malicious version to execute code in the context of a trusted Microsoft process.
Detects suspicious image loads where a renamed Microsoft .NET ClickOnce Launch Utility or other .NET masquerading binaries sideload mscoree.dll or msvcp140.dll from the ProgramData directory. This behavior is associated with the Lorem Ipsum threat activity.
Detects the ClickOnce shim DLL (dfshim.dll) being loaded by non-standard processes, indicating potential sideloading or execution abuse. The rule specifically excludes common legitimate processes like explorer.exe, rundll32.exe, dfsvc.exe, and presentationhost.exe from triggering an alert.
This rule detects potential DLL side-loading activity associated with the SilverFox threat actor, specifically targeting trojanized Panasonic and Philips OEM software. It looks for suspicious DLLs (UxEnhance64.dll, XPSPLOG.dll) being loaded, or legitimate Panasonic/Philips binaries loading DLLs from non-standard paths, including the Public user directory.
Detects the deployment of SharkLoader components into suspicious directories (%APPDATA%\xwreg, %APPDATA%\xgdf, or %ProgramData%\KasperskyLab) followed by the execution of SystemSettings.exe from these locations. This rule also tracks the loading of encrypted DLL payloads like DscCoreR.mui or SyncRes.dat by these processes, which is indicative of a DLL sideloading execution chain.
Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.
Detects the loading of ntdll.dll or amsi.dll by the Windows Update Service (wusvc.exe). This pattern is often observed in the context of advanced techniques like SNOWLIGHT, which uses direct syscall table enumeration to bypass security controls. Monitoring for these modules in this specific process context can indicate memory-resident malicious activity or evasion attempts.
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
This rule detects EDR evasion techniques associated with the SNOWLIGHT dropper used by UNC5221. It identifies two specific behaviors: the manual loading of ntdll.dll from non-standard Windows directories, which suggests an attempt to bypass EDR hooks through manual mapping and direct syscalls, and the loading of amsi.dll by processes running from user-writable directories (e.g., Temp, Downloads), indicative of an in-memory AMSI bypass.
Detects the SNOWLIGHT dropper (associated with UNC5221) attempting to evade analysis. The rule monitors for the loading of 'verifier.dll' by the suspicious 'wusvc.exe' process (a common disguise for this malware) as a mechanism to perform debugger checks, alongside the enumeration of various security and analysis tools (e.g., debuggers, packet sniffers, and virtualization tools).
This rule detects potential memory-resident malware or staging activity by identifying instances where a high volume of DLL, OCX, or SYS files are loaded from user-writable directories (Temp, AppData, Users) on a specific device within a one-hour window. A threshold of 5 or more unique image loads from these locations is flagged as potentially suspicious, as it may indicate an attacker loading multiple malicious components or modules.
Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.
Page 28 of 56