Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process. This rule specifically looks for the arubanetsvc.exe process loading specific DLLs (wtsapi32.dll, msvcr100.dll, msvcp100.dll, dbghelp.dll, dbgcore.dll, wininet.dll, iphlpapi.dll, version.dll, cryptsp.dll, cryptbase.dll, wldp.dll, profapi.dll, sspicli.dll, winsta.dll, dpapi.dll) from a location other than the standard Windows system directories (C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This behavior is indicative of DLL Search Order Hijacking, where an attacker places a malicious DLL in a directory that is searched before the legitimate system DLLs, causing the application to load the malicious version.
Detects the loading of the "taskschd.dll" module from a process that is located in a potentially suspicious or uncommon directory. The loading of this DLL might indicate that the application has the capability to create a scheduled task via the "Schedule.Service" COM object. Investigation of the loading application and its behavior is required to determine if it is malicious.
This rule detects when a ClickOnce application loads an unsigned or expired-signature module. ClickOnce applications are typically found in the `\AppData\Local\Apps\2.0\` directory. The detection specifically looks for image load events where the image path matches this ClickOnce application directory pattern and the loaded module's signature status is either 'false' (unsigned) or 'Expired'. This behavior can be indicative of an adversary abusing ClickOnce for trusted code execution, potentially for privilege escalation, defense evasion, or persistence, by injecting or replacing modules with malicious unsigned ones.
This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.
This rule detects specific DLL sideloading activity observed to be used by the Diamond Sleet APT group. It looks for the loading of 'Version.dll' by 'clip.exe' or 'DSROLE.dll' by 'wsmprovhost.exe' when these executables and DLLs are located in the 'ProgramData' directory. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their crafted DLLs.
Detects potential DLL sideloading of Python DLL files (python39.dll, python310.dll, python311.dll, python312.dll) by monitoring image load events. The rule filters out legitimate loads from common Python installation paths, Visual Studio, Anaconda, CPython build paths, and PyInstaller bundled applications, as well as legitimately signed Python DLLs, to reduce false positives.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects the loading of .NET Common Language Runtime (CLR) DLLs by scripting applications such as wscript, cscript, or mshta. This behavior can indicate suspicious execution, potentially involving techniques like DotNetToJScript or Donut, which use scripting hosts to execute .NET assemblies in memory. The rule specifically looks for `clr.dll`, `mscoree.dll`, or `mscorlib.dll` being loaded by a predefined list of scripting or utility executables.
Detects the sideloading of specific trojanized DLLs by legitimate Windows executables, a technique observed in Lazarus APT campaigns targeting a Spanish aerospace company. The rule identifies suspicious DLL loads by monitoring 'ImageLoaded' events for particular DLLs being loaded by specific executables from unusual paths, indicating potential DLL hijacking or sideloading for persistence, privilege escalation, or defense evasion.
Detects attempts to load images or drivers that violate Windows Code Integrity policies, indicating a potential bypass attempt or the execution of unsigned/malicious code. This event signifies that the system blocked the load due to unmet authenticode signing level requirements or a policy violation.
Detects potential DLL sideloading of 'AVKkid.dll' by monitoring image load events. The rule specifically looks for 'AVKkid.dll' being loaded by any process, and then filters out legitimate loads by G DATA antivirus software from its expected installation paths. This helps identify malicious instances where 'AVKkid.dll' might be used for persistence, defense evasion, or privilege escalation outside of its legitimate context.
Detects potential DLL sideloading of "appverifUI.dll" when loaded by an 'appverif.exe' process from a non-standard or suspicious location. This rule aims to identify instances where an attacker might place a malicious 'appverifUI.dll' in a directory that 'appverif.exe' would load before its legitimate counterpart, leading to execution of the malicious DLL.
Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.
This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Page 41 of 56