Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects when a ScreenConnect installer or related process loads the 'vcredist_x64.dll' file from a temporary, downloads, or AppData folder. This behavior can indicate DLL side-loading, where a malicious DLL is placed in a location that a legitimate application will search before its intended, trusted location, potentially for privilege escalation or persistence.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
Detects instances where explorer.exe loads a DLL file from within C:\ProgramData. This behavior is often associated with adversary activity attempting to hide malicious modules in directories that may have permissive write access or are excluded from routine scans, including techniques used by Covenant frameworks or C2 agents.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe, indicating active DSC processing. This is a strong indicator of WinGet DSC execution, which is abused by tools like DSCourier.
Detects the creation of a randomly named .ocx file in temporary directories (AppData\Local\Temp or Windows\Temp) followed by its loading by a process. This behavior is indicative of OXLOADER malware staging shellcode, where 'dui70.dll' is often copied and renamed to a .ocx file. Exclusions are in place for common legitimate processes like msiexec.exe and regsvr32.exe.
Detects the loading of DLLs named 'Optimax.dll' or 'System Optimizer Ultimate.dll', which are associated with potentially unwanted programs (PUPs) or malicious software. The rule also identifies a specific malicious hash for 'Optimax.dll'.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects the loading of specific DLLs (7z.dll, normaliz.dll) from user-writable directories like AppData, Temp, Roaming, or Local, excluding legitimate installations of 7-Zip or Windows system directories. This behavior can indicate DLL sideloading or other forms of malicious code execution where an attacker places a malicious DLL in a location that a legitimate application will load.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Detects the malware reading seemingly benign .bmp files from disk, which actually contain the steganographically encoded secondary payload. This rule specifically looks for a process accessing a .bmp file and then loading an image from the 'C:\Users\Public' folder, indicating a potential steganographic attack where a malicious payload is hidden within a benign image file.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Detects a spoofed utility executable (like CrystalDiskInfo via MSI) loading the malicious autorun.dll from the downloads path, indicative of a cryptojacking campaign.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects Python loading a .pyd or .so extension from common user-controlled directories like AppData, Temp, Downloads, or project directories, rather than from a trusted package installation. This behavior is indicative of the InvisibleFerret malware.
Detects the usage of Fox Tempest certificates to sign and load malicious .sys drivers into the Windows kernel space to blind EDR. The rule specifically looks for signed .sys files being loaded from temporary or downloads folders.
Page 31 of 56