Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Identifies LNK shortcut files contained in ISOs executing the Fox Tempest signed payload, bypassing initial scrutiny. This rule specifically looks for 'explorer.exe' initiating a process with a command line containing '.lnk' and then joins this with image load events where the initiating process's signature status is 'Valid'. This combination aims to detect the execution of malicious LNK files that launch signed binaries, a technique used by threat actors like Fox Tempest.
Detects the loading of specific suspicious library files (SyncRes.dat, SystemSettings.dll, DscCoreR.mui) from the AppData Roaming directory subfolders 'xwreg' or 'xgdf'. This activity is often associated with file masquerading or persistence techniques where malicious code is executed under the guise of legitimate-sounding system files.
This rule detects when 'SystemSettings.dll' is loaded by a process other than the legitimate 'SystemSettings.exe' located in the Windows ImmersiveControlPanel directory. This behavior can be indicative of DLL hijacking or unauthorized code injection into a system-level component.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
The detection monitors for the loading of specific files ('SyncRes.dat' or 'DscCoreR.mui') that are known to be used as side-loading targets for malicious DLLs. These file names are frequently associated with various malware campaigns leveraging DLL search order hijacking to execute malicious code within the context of trusted applications.
Detects anomalous file activity and process execution associated with the SharkLoader malware family. The rule looks for the loading of specific component files (DscCoreR.mui, SyncRes.dat, SystemSettings.dll) from suspicious directories, as well as the execution of SystemSettings.exe from non-standard AppData or ProgramData paths, which indicates a beacon injection or execution chain.
Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.
Detects the loading of amsi.dll into a process, excluding common trusted security processes. This behavior is often indicative of an attempt to interact with or bypass the Antimalware Scan Interface (AMSI) by non-security software, which can be a precursor to executing obfuscated scripts or malicious code.
Detects the SNOWLIGHT dropper process (masquerading as wusvc.exe) dynamically loading advapi32.dll and invoking GetUserNameA via hash-based API resolution. This behavior is indicative of malware performing system owner/user discovery.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
Detects instances where suspicious processes load the amsi.dll module, which is a common precursor to performing in-memory patching of the AmsiScanBuffer function. This behavior is indicative of an attempt to disable Anti-Malware Scan Interface (AMSI) to evade security scanning, specifically observed in techniques like the SNOWLIGHT dropper.
Detects Pay2Key ransomware activity involving the extraction of suspicious DLLs into the Avast installation directory and the subsequent loading of these unsigned/unauthorized DLLs by legitimate Avast processes. This rule covers the file creation of known malicious DLL names, the use of 7za.exe for extraction into the directory, and the process module load events for unsigned DLLs within the Avast scope.
Detects the loading of amsi.dll by a non-Microsoft signed process. This behavior is indicative of processes attempting to hook or patch AMSI (Antimalware Scan Interface) functions in memory to evade detection, a technique commonly used by malware droppers to neutralize security scanning.
Detects InstallService.exe loading the InstallServicePlugin.dll from a remote UNC path. This behavior is associated with the UnCanny Coercion technique, which exploits a vulnerability in the Windows Installer service to load arbitrary DLLs from remote shares.
Detects MsBuild.exe loading memory-resident .NET assemblies post-hollowing.
Detects the EDR Killer utility restoring or unhooking user-mode APIs in ntdll.dll (by reading a fresh copy from disk into memory) before it begins communicating with the vulnerable kernel driver. This is identified by a file access event on ntdll.dll in System32 folder, joined with an image load event for EEDbg.sys by the same initiating process.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
Page 32 of 56