Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,456
11,839
5,876
5,155
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
Detects attempts to load the 'mscoree.dll' library by processes like PowerShell, setup, or main executables. This activity can indicate an in-memory .NET assembly load, often used by adversaries for stealthy execution (T1620).
Identifies a signed binary associated with Fox Tempest loading an unsigned, anomalous DLL from the same directory, specifically from common user-writable directories like Downloads, Temp, or AppData. This behavior is indicative of DLL side-loading for defense evasion or privilege escalation.
Detects the loading of amsi.dll by specific suspicious executable names, which may indicate an attempt to interact with or bypass the Antimalware Scan Interface (AMSI).
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Identifies potential DLL sideloading by detecting a signed process loading an unsigned or low-prevalence DLL from its own directory, followed by that same process spawning a command interpreter (cmd.exe, powershell.exe, or pwsh.exe) within a one-hour window.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
Detects python.exe loading non-standard Cython modules.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects malicious UnityPlayer.dll reading the encrypted Com.dat container for decryption routines, indicative of the 'Dragon Weave' campaign.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Maps the attack path where the IIS worker process (w3wp.exe) executes certutil to download a payload, followed immediately by sideloading a malicious DLL into a signed binary. This rule specifically looks for `w3wp.exe` initiating `certutil.exe` and then a subsequent image load event where a DLL (`mscoree.dll`, `mpclient.dll`, or `oci.dll`) is loaded by a process with a valid signature.
This rule detects potential credential harvesting activity associated with the Hannibal Stealer. It looks for non-standard processes (processes other than the browsers themselves) that access sensitive browser credential stores (like 'Login Data', 'cookies.sqlite', or 'key4.db') and correlate these file access events with the loading of 'bcrypt.dll' or 'CefSharp.BrowsersSubprocess.dll', which are often used for decryption or browser automation/sub-processes during credential theft.
Identifies instances where update.exe enforces an svchost.exe parent to evade sandboxes, specifically looking for 'UpdateChecker.dll' being loaded by a process named 'update.exe' whose parent is 'svchost.exe'. This behavior is associated with the Screening Serpens APT group.
This rule detects outbound Command and Control (C2) beaconing activity by the `UpdateChecker.dll` to Azure Websites, which is indicative of the Screening Serpens APT group. It specifically looks for the loading of `UpdateChecker.dll` followed by network connections to domains ending in `azurewebsites.net` from the same initiating process.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Identifies sideloading of endpointdlp.dll by legitimate Microsoft Defender binary mpextms.exe.
Detects the creation or execution of a file named 'agt.dll' within a masqueraded 'CorsairUtil' directory, a defense evasion tactic used by the Vidar Turb00 campaign. This rule monitors both file drops (DeviceFileEvents) and DLL loads (DeviceImageLoadEvents) for the specific path and filename combination.
Page 33 of 56