Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects the loading of graphics-related DLLs (gdiplus.dll, gdi32.dll, gdi32full.dll) by processes executing from typically writable directories such as Temp, AppData, or ProgramData. This behavior is consistent with the screen capture functionality of the JFMBackdoor (Red Lamassu), which utilizes these libraries to capture, encode, and stage screen images.
This rule detects processes that load .NET-related modules (clr.dll or dotnet.exe) and maintain a network connection (port 80 or 443) for more than one hour during standard business hours. This behavior is indicative of potentially persistent, long-running .NET-based applications or potentially malicious tools maintaining persistence and C2 communication.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
This rule detects suspicious process injection activity characterized by a sequence of API calls (VirtualAlloc, CreateRemoteThread, WriteProcessMemory) in conjunction with the loading of 'mpr.dll'. This combination of events can indicate an attempt to inject malicious code into a process, potentially for evasion or privilege escalation. The rule filters out common legitimate processes to reduce false positives.
Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).
Detects the loading of the avicap32.dll library (often used for webcam/audio capture) by unexpected processes, or any file access activity within the 'C:\MicRecords\' directory, which may indicate unauthorized surveillance or credential/audio harvesting.
Detects instances where CefSharp.BrowsersSubprocess.exe or processes within the SCef.WindowsAdapter folder load the iphlpapi.dll library, combined with command-line arguments indicative of network configuration discovery, such as retrieving MAC addresses, BSSIDs, or default gateways. This activity suggests potential reconnaissance by an application or a process masquerading as a browser component.
Detects the loading of the system dynamic link library USER32.dll by a process executing from a suspicious directory within AppData\Roaming\Traiolx Custom Utils\. This behavior is consistent with potential DLL side-loading or process injection attempts where a process residing in a non-standard or user-writable location attempts to interact with critical OS system modules.
Detects a behavioral pattern associated with LegionLoader malware, where a process running from the 'AppData\Roaming' directory loads 'user32.dll' or 'kernel32.dll'. This pattern is frequently used to dynamically resolve GUI interaction APIs (such as MessageBoxA) via GetProcAddress as an anti-analysis and obfuscation technique.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects suspicious files, modules, or batch scripts executed from or staged within AppData Roaming directories, specifically targeting known patterns such as custom utils folders, DLL sideloading impersonation (e.g., 7z.dll, normaliz.dll), and Python C2 module components.
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Detects instances where a legitimately signed executable located in protected system directories (System32, SysWOW64, Program Files) loads a DLL module from common user-writable directories (Temp, AppData, Public, ProgramData). This behavior is characteristic of DLL sideloading, where an adversary leverages a trusted binary to execute malicious code contained in a side-loaded DLL.
Detects execution of InvisibleFerret backdoor logic as a Shared Object on macOS.
Detects the sideloading of ark.x64.dll when a legitimate Bandizip.exe is executed from a non-standard path.
Detects a benign executable loading a nearby DLL that reads and executes a data file containing an embedded .NET backdoor. This technique is often used by threat actors to evade detection by leveraging legitimate processes and file types.
Detects instances where the 'consent.exe' process (typically a Windows system utility) loads a DLL named 'msimg32.dll' from a user-writable Temp directory. This behavior is indicative of DLL search order hijacking or side-loading, where an attacker plants a malicious library in a directory that a process prioritizes during the search for dependencies.
Detects suspicious module loads (DLLs) by the Windows Consent UI process (consent.exe) or from an application installation folder in the temporary directory. This pattern is indicative of potential DLL side-loading or hijacking, where an adversary places a malicious DLL in an unexpected location to be loaded by a legitimate process.
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
Detects the Bumblebee loader technique where a trojanized installer drops the legitimate Windows binary consent.exe and a malicious msimg32.dll into a temporary directory. The rule flags instances where consent.exe loads msimg32.dll from an AppData subfolder, indicating a DLL search order hijacking attempt rather than loading the trusted system library.
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Page 30 of 56