Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Detects processes loading a Lua library (DLL), which could indicate the execution of an embedded Lua script for post-exploitation. This technique was demonstrated in the LOLMIL (Living Off the Land Models and Inference Libraries) research where an autonomous malware used an embedded Lua interpreter to run dynamically generated code.
The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.
Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
The analytic detects a process loading the `credui.dll` or `wincredui.dll` module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
Detects the image load of 'vsstrace.dll' by executables that are not typically associated with legitimate Windows operations or known backup solutions. This behavior can indicate an adversary attempting to manipulate or delete Volume Shadow Copies, often as a precursor to data encryption for impact (ransomware) or to hinder system recovery.
Detects the creation of a scheduled task that launches an executable from a non-standard, writable directory, which subsequently loads a co-located DLL. This pattern is a form of DLL Sideloading used for persistence and was observed in a ToddyCat APT attack.
Detects WMI command line event consumers
The analytic detects instances where a Dynamic Link Library (DLL) is loaded from a temporary directory on a Windows system. Loading DLLs from non-standard paths such as %TEMP% is uncommon for legitimate applications and is often associated with adversary tradecraft, including DLL search order hijacking, side-loading, or execution of malicious payloads staged in temporary folders. Adversaries frequently leverage these directories because they are writable by standard users and often overlooked by security controls, making them convenient locations to drop and execute malicious files. This behavior may indicate attempts to evade detection, execute unauthorized code, or maintain persistence through hijacked execution flows. Detection of DLL loads from %TEMP% can help surface early signs of compromise and should be investigated in the context of the originating process, user account, and potential file creation or modification activity within the same directory.
This detection identifies unsigned DLLs loaded through DLL side-loading where the DLL shares the same file path as the process that loaded it. This technique is observed in malware like DarkGate and PlugX. The rule monitors DLL loading events, verifies digital signatures, and flags unsigned DLLs. It specifically excludes DLLs loaded from standard Windows system directories and Program Files to reduce false positives. Detecting such suspicious DLLs is crucial in preventing privilege escalation and other security breaches.
Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec, Bitdefender, F-Secure, CyberArk, Avast, ESET, and Trend Micro. The rule identifies when specific DLLs associated with these security products are loaded from an unexpected or non-standard directory, indicating a possible attempt to hijack the execution flow.
A DefenderXDR Custom Detection for CVE-2025-56383
Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. The rule filters out legitimate loads from common installation paths and specific applications like Eclipse.
Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.
Detects potential DLL sideloading of 'dbgcore.dll' by identifying instances where this DLL is loaded from non-standard or unexpected file paths. This technique can be used by adversaries for defense evasion, persistence, and privilege escalation.
Detects Windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse these programs to proxy execution of malicious code, bypassing application control and potentially evading detection. The rule specifically targets `InstallUtil.exe`, `RegAsm.exe`, `RegSvcs.exe`, `regsvr32.exe`, and `rundll32.exe` when they load DLLs that are not signed or have an invalid signature status. It includes filters for common legitimate scenarios to reduce false positives.
Detects the loading of 'Amsi.dll' by specific Living Off the Land Binaries (LOLBINs) such as ExtExport.exe, odbcconf.exe, and rundll32.exe. This activity can indicate an attempt to bypass Antimalware Scan Interface (AMSI) protections, often associated with 'PowerShell without PowerShell' attacks where malicious scripts are executed without directly invoking powershell.exe.
Page 43 of 56