Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Detects potential DLL sideloading of "mscorsvc.dll".
Detects any assembly DLL being loaded by an Office Product
Detects potential DLL sideloading of "7za.dll"
Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories).
Usually this technique is used to achieve UAC bypass or privilege escalation.
Usually this technique is used to achieve UAC bypass or privilege escalation.
Detects potential DLL sideloading of "DbgModel.dll"
Detects the load of RstrtMgr DLL (Restart Manager) by a suspicious process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects DSParse DLL being loaded by an Office Product
Detects potential DLL sideloading using comctl32.dll to obtain system privileges
Detects potential DLL sideloading of "ShellDispatch.dll"
Detects loading and execution of an unsigned thor scanner binary.
Detects potential DLL sideloading of "mfdetours.dll". While using "mftrace.exe" it can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution.
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
Detects loading of "Amsi.dll" by a living of the land process. This could be an indication of a "PowerShell without PowerShell" attack
Detects processes loading modules related to PCRE.NET package
Detects loading of essential DLLs used by PowerShell by non-PowerShell process.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects behavior similar to meterpreter's "load powershell" extension.
Detects the image load of VSS DLL by uncommon executables
Detects Kerberos DLL being loaded by an Office Product
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Page 50 of 56