Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Detects potential DLL sideloading of "DbgModel.dll"
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
Detects potential DLL sideloading of "SolidPDFCreator.dll"
Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects potential DLL sideloading of "wwlib.dll"
Detects unsigned module load by ClickOnce application.
Detects windows utilities loading an unsigned or untrusted DLL.
Adversaries often abuse those programs to proxy execution of malicious code.
Adversaries often abuse those programs to proxy execution of malicious code.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
It could be an indicator of SquiblyTwo technique, which uses Windows Management Instrumentation (WMI) to execute malicious code.
Detects suspicious behavior associated with an Adobe Reader zero-day exploit, including specific network connections, suspicious user-agent strings, registry persistence, and specific image loads (e.g., ntdll.dll or bootsvc.dll).
Detects cmstp loading "dll" or "ocx" files from suspicious locations
Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack
Detects rundll32 loading a renamed comsvcs.dll to dump process memory
Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
Detects usage of Time Travel Debugging Utility. Adversaries can execute malicious processes and dump processes, such as lsass.exe, via tttracer.exe.
Detects the image load of vss_ps.dll by uncommon executables. This DLL is used by the Volume Shadow Copy Service (VSS) to manage shadow copies of files and volumes.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
It is often abused by attackers to delete or manipulate shadow copies, which can hinder forensic investigations and data recovery efforts.
The fact that it is loaded by processes that are not typically associated with VSS operations can indicate suspicious activity.
Detects PowerShell core DLL being loaded by an Office Product
Page 36 of 56