Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from
attacker-controlled WebDAV servers loading the Windows system DLLs like gdi32.dll, netapi32.dll, etc.
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
Detects WMI modules being loaded by an uncommon process
Detects Microsoft Excel loading an Add-In (.xll) file
Detects the image load of "Python Core" by a non-Python process. This might be indicative of a Python script bundled with Py2Exe.
Detects potentially suspicious loading of "ksproxy.ax", which may indicate an attempt to exploit CVE-2024-35250.
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Detects loading of "credui.dll" and related DLLs by an uncommon process. Attackers might leverage this DLL for potential use of "CredUIPromptForCredentials" or "CredUnPackAuthenticationBufferW".
Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.
Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Detects DLL's Loaded Via Word Containing VBA Macros Executing WMI Commands
Detects potential DLL sideloading of "EACore.dll"
Detect DLL Load from Spooler Service backup folder
Detects potential DLL sideloading of "dbghelp.dll"
Detects potential DLL sideloading of "CCleanerReactivator.dll"
Detects SILENTTRINITY stager dll loading activity
Page 45 of 56