Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects when the Microsoft Management Console (MMC) loads the DLL libraries like vbscript, jscript etc which might indicate an attempt
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
to execute malicious scripts within a trusted system process for bypassing application whitelisting or defense evasion.
Detects the loading of 'libcurl.dll' from suspicious or temporary directories such as ProgramData, Users\Public, or Temp. This behavior is associated with DLL side-loading techniques, such as those used by the BRUSHLOGGER keylogger which masquerades as 'libcurl.dll' to execute malicious code and capture keystrokes.
This rule detects the presence or execution of files identified by specific SHA256 hashes or file names associated with PAM-based backdoors on Linux systems. It monitors device events, file events, process events, and image load events for these indicators. The rule aims to identify the 'Plague' PAM-based backdoor or similar malicious PAM modules.
Detects non-standard processes (e.g., command shells, script hosts) loading WinRT notification and push app libraries (wpnapps.dll, notificationcontroller.dll), which may indicate an implant or script attempting to send spoofed toast notifications for social engineering.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.
Detects the loading of jli.dll from the C:\ProgramData\USOShared directory. This behavior is indicative of DLL sideloading via a legitimate Java process, a consistent post-exploitation tactic used by the LeakNet ransomware group.
Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).
Detects the sideloading of libvlc.dll or hostfxr.dll when VLC.exe or WingetUI.exe are executed from the non-standard C:\ProgramData\PolGuid\ directory, a TTP associated with the Dust Specter APT group.
This rule looks for a Python process loading a helper file called python20.dll, which was part of the toolset used in the CL-UNK-1068 activity. The rule is useful because it combines two details that are not common together in modern normal use: a current Python process and an old helper file name used as a loading trick. It does not try to flag every Python action or every helper file, which helps reduce noise. In plain language, the rule is meant to catch a hidden helper attached to Python that can be used to start other attacker tools while blending in with a familiar program name. When this match appears, it can point to scanning, hidden connections, or other follow-on activity described in the campaign. The focus on the exact file name helps keep the match useful and lowers the chance of confusing it with ordinary Python use.
Detects the DLL side-loading of 'BugSplatRc64.dll' by 'wsprint.exe' from the 'C:\ProgramData' directory. This is a specific technique used by the China-nexus actor UAT-9244 to load the TernDoor backdoor.
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Detects instances of specific legitimate binaries loading known malicious proxy DLLs. This pattern targets the exact sideloading pairs identified in a campaign leveraging a modified Havoc C2 agent.
Detects the loading of 'version.dll' by 'filezilla.exe' from a non-system directory. This behavior is a strong indicator of a DLL Sideloading attack used by a trojanized FileZilla variant. Legitimate FileZilla distributions do not ship with this DLL.
Detects the loading of malicious DLLs (e.g., "propsys.dll", "batmeter.dll") by legitimate Windows binaries ("Fondue.exe", "mblctr.exe", etc.) from non-standard, user-writable locations.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
This rule identifies various activities associated with the Dohdoor malware campaign, combining multiple detection heuristics into a single result set. It looks for PowerShell executing curl to download batch scripts, copied Windows tools run from shared folders with unusual arguments, suspicious DLL loads from shared folders, and network connections to C2-style domains identified in the campaign.
Detects a library file with a common Windows name being loaded from a shared folder instead of the Windows folders. This can be a sign that a fake library file is being used to run harmful code.
Detects DLL side-loading attacks using legitimate security software binaries (but often targeted)
to execute malicious DLL payloads, covering various security vendors commonly abused.
to execute malicious DLL payloads, covering various security vendors commonly abused.
Detects the execution or loading of the Tiny C Compiler (TCC) runtime (libtcc.dll, tcc.exe) by non-development processes. This 'living-on-edge' compilation technique, observed in use by actors like Lotus Blossom, helps bypass static file-based detections by compiling malicious code directly on the host.
Detects DLL side-loading attacks using legitimate security software binaries (but often targeted)
to execute malicious DLL payloads, covering various security vendors commonly abused.
to execute malicious DLL payloads, covering various security vendors commonly abused.
Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired.
This event is best correlated with EID 3089 to determine the error of the validation.
This event is best correlated with EID 3089 to determine the error of the validation.
Page 39 of 56