Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects Pay2Key ransomware attempting DLL search order hijacking against Avast Antivirus components. The rule monitors for two behaviors: Windows system DLLs (e.g., powrprof.dll) being loaded from the Avast installation directory, and Avast-specific component DLLs (e.g., snxhk.dll, ashBase.dll) being loaded from non-standard file paths outside the legitimate Avast software installation directory.
This rule detects potential memory-resident malware or staging activity by identifying instances where a high volume of DLL, OCX, or SYS files are loaded from user-writable directories (Temp, AppData, Users) on a specific device within a one-hour window. A threshold of 5 or more unique image loads from these locations is flagged as potentially suspicious, as it may indicate an attacker loading multiple malicious components or modules.
This rule detects the suspicious behavior where the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library into memory without any corresponding file creation or modification events for that DLL. This pattern is indicative of reflective code loading or fileless execution techniques often associated with Backdoor.Mistic (MLTBackdoor), where malicious code is executed directly from memory to evade disk-based security controls.
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
Identifies PowerShell utilizing rstrtmgr.dll to list processes, avoiding Get-Process.
Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.
Detects the loading of amsi.dll by processes frequently associated with PyInstaller or potential AMSI patching attempts. This rule monitors EventCode 7 (ImageLoad) events specifically identifying instances where amsi.dll is loaded by processes containing '_mei' (a common temporary directory prefix for PyInstaller), python executables running from temporary directories, or processes named 'winupdate.exe'. Such activity is often observed during the execution of obfuscated or packaged malicious binaries attempting to disable or bypass AMSI (Antimalware Scan Interface).
Detects the loading of the 'avicap32.dll' (Video Capture API) module by processes that are not recognized as legitimate media, conferencing, or streaming applications. This behavior is often associated with remote access tools (RATs) like Atlas RAT, which may use this library to covertly capture video from a webcam.
This rule identifies suspicious activity associated with PyInstaller-packaged executables (specifically 'BQT.exe' and 'start.exe'). It detects these processes directly, or any processes that initiate them while referencing anti-analysis markers like debugger checks ('IsDebuggerPresent'), internal PyInstaller environment variables, or specific path markers like '_MEIPASS'. This behavior is characteristic of malware attempting to evade sandbox or manual analysis.
Detects instances where QEMU-related binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, or ADNotificationManager.exe) load modules from locations other than the standard Windows system directories or the authorized QEMU installation directory. This behavior is indicative of potential DLL side-loading or hijacking attempts, where a malicious DLL is placed in the same directory as the executable to be loaded by the application.
Detects the specific pattern of ADNotificationManager.exe loading the vcruntime140_1.dll, which is a known indicator of DLL side-loading used in the Gold Encounter attack chain.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects the loading of unsigned or improperly signed DLLs by high-value/legitimate Windows binaries (e.g., mmc.exe, OneDrive.exe, teams.exe, rundll32.exe) from user-writable directories such as AppData, Temp, Downloads, or ProgramData. This behavior is indicative of DLL search-order hijacking or DLL side-loading, often used by adversaries to execute malicious code within the context of trusted applications.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects execution of CRYPTBASE.dll from non‑system directories, a technique used in the STX RAT campaign to hijack legitimate installers (e.g., CPUID HWMonitor, X‑VPN).
This rule detects potential DLL sideloading of 'DtlCrashCatch.dll' by the 'IntelAudioService.exe' process, as well as the execution of 'IntelAudioService.exe' from suspicious user-profile directories with specific command-line arguments indicative of the SPECTRALVIPER malware execution chain.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects DLL sideloading behavior associated with OceanLotus (APT32) where legitimate, signed executables (e.g., HP or Autodesk utilities) are renamed and executed with a -uiDll command-line parameter. The rule monitors both the process creation of these renamed executables in suspicious paths and subsequent image load events of DLLs with non-standard extensions, indicating the loading of malicious payloads.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects execution of the legitimate Windows filter manager utility 'fltMC.exe' from temporary directories combined with the loading of a 'FLTLIB.dll' file from a similarly suspicious location. This pattern is indicative of DLL side-loading, often associated with the JFMBackdoor malware (Red Lamassu).
Page 29 of 56