Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,164 detections
Filters
Last updated
All Time
Detection languages
520
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,453
11,837
5,876
5,154
4,865
1,164
Platforms
1,143
28
18
1
Products / Services
430
403
35
18
15
MITRE Techniques
814
472
460
442
429
CVEs
6
6
5
5
3
This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.
This rule detects suspicious loading of common DLLs (mshtml.dll, mscoree.dll, clr.dll, kernel32.dll, advapi32.dll) by VBScript interpreters (wscript.exe or cscript.exe). This activity can be indicative of phishing attacks or malicious script execution attempting to interact with system components or the .NET framework.
Detects the PUP installer dropping an outdated, legitimate application (e.g., old versions of VLC or Notepad++) alongside a malicious DLL to execute a sideloading attack. The rule identifies file creation events for DLLs followed by an image load event for an unsigned DLL within a short time frame, where the initiating process for the image load has a valid signature.
Detects the loading of DLLs with suspicious names ('hook.dll', 'inject.dll', 'logger.dll', 'loader.dll') from common user-writable directories such as 'Temp', 'AppData', or 'Downloads'. These patterns are frequently associated with malware loaders, persistence mechanisms, or unauthorized code injection attempts.
Detects the loading of the Huawei HWAuidoOs2Ec.sys driver, which has been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks for defense evasion and privilege escalation.
Detects attempts to sideload a malicious DLL named 'NotepadPlusPlus.dll' from a user's AppData folder. This technique is often used by adversaries to achieve persistence, escalate privileges, or evade defenses by masquerading malicious code as a legitimate library.
This rule detects the loading of 'tpsvcloc.dll' from the 'Windows\Fonts' directory by a process associated with ThinPrint. This behavior is indicative of DLL sideloading, where a malicious DLL is placed in a location that a legitimate application (ThinPrint in this case) will load, allowing for arbitrary code execution. The rule specifically looks for image load events where the module name is 'tpsvcloc.dll', the module path is within 'Windows\Fonts', and the actor process image path contains 'thinprint', 'tpsvc', or 'tp*.exe'.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Identifies payload loading malicious SbieDll.dll from an anomalous path.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Detects the loading of 'borlndmm.dll' from unusual directories, an activity associated with OnyxC2 stealer DLL side-loading techniques, where the malicious DLL is typically inflated via binary padding to evade detection.
Identifies RuntimeBroker_update.exe sideloading the malicious Rust loader masquerading as UnityPlayer.dll. This detection specifically looks for the loading of 'UnityPlayer.dll' by 'RuntimeBroker_update.exe' in conjunction with the presence of a 'Com.dat' file, indicating the RUSTCLOAK malware's DLL sideloading technique.
Generalized advanced detection for DLL sideloading from unprotected directories (Downloads, Temp, Public) followed by network beaconing. This rule identifies specific DLLs (autorun.dll, UnityPlayer.dll, UpdateChecker.dll, uevmonitor.dll) being loaded from these suspicious locations and then initiating network connections.
This rule detects suspicious activity where a malicious DLL (AggregatorHost.dll) is injected into a process that then explicitly interacts with 'steam.exe' by accessing its files. This behavior is indicative of malware targeting Steam users, potentially to steal credentials or items.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe, indicating active DSC processing. This is a strong indicator of WinGet DSC execution, which is abused by tools like DSCourier.
Detects the loading of known trojanized native extensions (.abi3.so files) used in compromised bioinformatics PyPI packages (like ensmallen) as part of the Miasma/Hades campaign. Specifically targets 'ensmallen_haswell.abi3.so' and 'ensmallen_core2.abi3.so'.
Detects loading of shared DLL modules from suspicious network paths
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe. This indicates active WinGet DSC execution, which can be abused by tools like DSCourier to proxy arbitrary code execution.
Detects execution of CRYPTBASE.dll from non‑system directories, a technique used in the STX RAT campaign to hijack legitimate installers (e.g., CPUID HWMonitor, X‑VPN).
Page 34 of 56