Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects the loading of 'wbemcons.dll' by 'WmiPrvSE.exe', which is indicative of a WMI command line event consumer being used for persistence. This technique is often leveraged by adversaries to maintain access and execute code when specific WMI events occur.
Detects potential DLL sideloading of 'iviewers.dll' (OLE/COM Object Interface Viewer) when it is loaded from a location other than the legitimate Windows Kits directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "SolidPDFCreator.dll" when loaded by an executable other than "SolidPDFCreator.exe" or from an unexpected directory. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of 'wwlib.dll' by identifying instances where 'wwlib.dll' is loaded by an executable that is NOT a legitimate Microsoft Office Word process. This rule specifically filters out loads from standard Microsoft Office installation paths for 'winword.exe' to reduce false positives.
This rule detects potential DLL sideloading of 'EACore.dll'. It specifically looks for instances where 'EACore.dll' is loaded by an executable, but the executable or the loaded DLL is not from the legitimate 'C:\Program Files\Electronic Arts\EA Desktop\EACoreServer.exe' path. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation by tricking legitimate applications into loading malicious DLLs.
Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.
This rule detects potential DLL sideloading of "edputil.dll". It specifically looks for instances where "edputil.dll" is loaded from a directory that is not a standard Windows system directory (C:\Windows\System32\, C:\Windows\SysWOW64\, or C:\Windows\WinSxS\). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of the legitimate one.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.
Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. This technique can be used for persistence, defense evasion, and privilege escalation.
This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Page 42 of 56