Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
This rule detects suspicious activity related to Notepad++ updater (gup.exe or update.exe) executing reconnaissance commands or loading suspicious DLLs. Specifically, it looks for the updater process initiating common reconnaissance tools like cmd.exe, powershell.exe, or curl.exe with commands such as 'whoami', 'tasklist', 'systeminfo', 'netstat', 'ipconfig', or 'curl' that include redirection for staging. Additionally, it correlates this activity with the loading of suspicious DLLs (e.g., log.dll) from unusual locations like AppData or Temp folders, potentially indicating DLL sideloading.
This rule detects suspicious activity related to Microsoft Distributed Transaction Coordinator (MSDTC) where the OracleOciLibPath registry value is modified, followed by msdtc.exe loading an unsigned oci.dll within a 4-hour window. This behavior can indicate an attempt to hijack the DLL loading process for persistence or privilege escalation, potentially by an attacker replacing the legitimate Oracle OCI library with a malicious one.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
This detection rule identifies potential DLL sideloading activity associated with the Lotus Blossom threat actor's Chrysalis backdoor. It searches for specific legitimate executables, often renamed from security products, loading suspicious DLLs from the same directory. The rule specifically looks for `BluetoothService.exe` loading `log.dll` or `tmdbglog.exe` loading `tmdglog.dll`, where both the process and the DLL reside in the same directory.
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
The rule detects the loading of log.dll into a process where the process executable is not located in the standard Bitdefender installation directories.
Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.
Detects DLL side-loading attacks where consent.exe loads known malicious
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
Detects a DLL sideloading technique used by APT41 where the legitimate VipreAV executable 'vetysafe.exe' is used to load a malicious 'sbamres.dll'. This is a known method for deploying the Deed RAT.
Detects Sysmon Image Load events for shdocvw.dll or ieframe.dll by Office applications, which indicates the Shell.Explorer.1 or Internet Explorer component is being loaded. This is a direct indicator of CVE-2026-21509 exploitation as Office normally doesn't load these browser-related DLLs. The vulnerability specifically exploits the Shell.Explorer.1 COM object which relies on these DLLs for browser functionality within Office documents.
Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.
Detects the legitimate 'pdf24.exe' process loading 'cryptbase.dll' from a non-standard directory. This is indicative of a DLL side-loading attack, a technique used by the PDFSIDER malware to achieve execution and bypass security controls.
Detects when a legitimate application, such as pdf24.exe, loads 'cryptbase.dll' from a non-standard directory. This is a known DLL side-loading technique used by the PDFSIDER malware.
This rule detects suspicious DLL loads by the 'consent.exe' process. It specifically looks for known DLLs often abused in DLL side-loading or hijacking scenarios, such as 'msimg32.dll', 'version.dll', 'rtworkq.dll', 'wmsgapi.dll', and other DLLs containing 'sh4nya' or 'shanya' in their name. The rule excludes legitimate Microsoft versions of 'wmsgapi.dll' and 'msimg32.dll' based on their SHA1 hashes to reduce false positives. The 'consent.exe' process is associated with User Account Control (UAC) and its abuse can lead to privilege escalation or defense evasion.
Detects a specific DLL side-loading pattern used by APT37 in the "Operation Artemis" campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is dropped into the %TEMP% directory along with a malicious 'version.dll'. The legitimate process is then executed, causing it to load the malicious DLL.
Detects the DLL sideloading technique used by the Evasive Panda APT group, where the legitimate and signed 'evteng.exe' executable is used to load the malicious 'libpython2.4.dll'.
Detects the loading of a vulnerable version of WindowsCodecs.dll (related to CVE-2025-50165) by non-standard applications. This could indicate an attempt to exploit the vulnerability in a custom or unexpected application context.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects DLL side-loading techniques used by Project AK47 loaders. This involves legitimate executables like 7z.exe or clink_x86.exe loading malicious DLLs with similar names from the same directory.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Page 40 of 56