Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading of "7za.dll"
Detects potential DLL sideloading of "appverifUI.dll"
Detects potential DLL sideloading of "AVKkid.dll"
Detects potential DLL sideloading of "CCleanerDU.dll"
Detects potential DLL sideloading of "CCleanerReactivator.dll"
Detects potential DLL sideloading using comctl32.dll to obtain system privileges
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects DLL sideloading of "dbgcore.dll"
Detects potential DLL sideloading of "dbghelp.dll"
Detects potential DLL sideloading of "EACore.dll"
Detects potential DLL sideloading of "edputil.dll"
Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"
Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects potential DLL sideloading of "MpSvc.dll".
Detects potential DLL sideloading of "mscorsvc.dll".
Detects loading of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes, potentially indicating phantom DLL hijacking attempts.
Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.
Phantom DLL hijacking involves placing malicious DLLs with names of non-existent system binaries in locations where legitimate applications may search for them, leading to execution of the malicious DLLs.
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Detects potential DLL sideloading of Python DLL files.
Page 37 of 56