Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects unsigned module load by ClickOnce application.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
This query looks for processes that load an older version of the system.management.automation libraries. While not inherently malicious, downgrading to PowerShell version 2
can enable an attacker to bypass some of the protections afforded by modern PowerShell. It is worth noting that some tools and scripts perform this to enable
backwards compatibility, so the technique is not inherently malicious. You will likely need to filter the processes within your environment that legitimately use this
capability for this to be effective.
can enable an attacker to bypass some of the protections afforded by modern PowerShell. It is worth noting that some tools and scripts perform this to enable
backwards compatibility, so the technique is not inherently malicious. You will likely need to filter the processes within your environment that legitimately use this
capability for this to be effective.
SCM DLL Sideload
Sigma
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism
Detects the Kapeka Backdoor binary being loaded by rundll32.exe.
The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
Detects loading of DLLs associated with Katz Stealer malware 2025 variants.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Detects potential DLL sideloading of "chrome_frame_helper.dll"
Detects DLL sideloading of "dbgcore.dll"
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Loading unsigned image (DLL, EXE) into LSASS process
Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.
Detects cmstp loading "dll" or "ocx" files from suspicious locations
Detects potential DLL sideloading of rcdll.dll
Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
Detects a remote DLL load event via "rundll32.exe".
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Detect usage of the "coregen.exe" (Microsoft CoreCLR Native Image Generator) binary to sideload arbitrary DLLs.
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.
Page 47 of 56