Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,443
11,831
5,875
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
Detects Microsoft Word loading an Add-In (.wll) file which can be used by threat actors for initial access or persistence.
Detects loading of Amsi.dll by uncommon processes
This query was originally published in the threat analytics report, ShadowHammer supply chain attack
Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems.
The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days.
References:
https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
https://www.asus.com/News/hqfgVUyZ6uyAyJe1
Operation ShadowHammer was an attack against ASUS computer hardware, using the company's own update infrastructure to deliver malware to the company's products. The campaign ran from June to November, 2018. ASUS has since responded with updates that protect their Live Update system, and diagnostic tools to check affected systems.
The following query checks for activity associated with the ShadowHammer implant or container over the past 30 days.
References:
https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-asus-software-updates-to-install-backdoors-on-thousands-of-computers
https://www.asus.com/News/hqfgVUyZ6uyAyJe1
These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs.
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
These queries was originally published in the threat analytics report, Attacks on gov't, think tanks, NGOs.
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
As described further in Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers, there was a very large spear-phishing campaign launched in November 2019.
The attackers would gain access to a target by having the user click on a link to a compromised website and download a .zip archive.
Once established on a target's device, the attackers used a malicious DLL named cyzfc.dat to execute additional payloads. They would call a function in the malicious DLL via the legitimate Windows process, rundll32.exe, to connect directly to their command-and-control (C2) servers.
The following queries detect activity associated with the malicious DLL, cyzfc.dat., used in this campaign.
Reference - https://docs.microsoft.com/windows-server/administration/windows-commands/rundll32
Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.
'This query uses Sysmon Image Load (Event ID 7) and Process Create (Event ID 1) data to look for COM Event System being used to load a newly seen DLL.'
This query is using the locations where malicious DLL images are often loaded from by regsvr32.dll and rundll32.exe.
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
Blog:
https://threathunt.blog/dll-image-loads-from-suspicious-locations-by-regsvr32-exe-rundll32-exe/
Surfaces suspicious spoolsv.exe behavior likely related to CVE-2021-1675
This query is looking for rarely seen processes which are launched as a service.
Author: Jouni Mikkola
More info: https://threathunt.blog/rare-process-launch-as-a-service/
Author: Jouni Mikkola
More info: https://threathunt.blog/rare-process-launch-as-a-service/
In the campaign where Bazarloader is delivered via emails containing pw protected zip attachments, regsvr32.exe is used to launch a malicious payload that is disguised as a JPG file.
Use this query to locate suspicious load image events by rundll32.exe or regsvr32.exe, a behavior associated with IcedId, which can lead to ransomware.
Detects potential CSharp Streamer RAT loading a .NET executable image by identifying a specific file name pattern and path commonly associated with the tool. This rule looks for image loads from a temporary directory with a filename matching 'dat[0-9A-Z]{4}\.tmp'.
This rule detects when the "BitsProxy.dll" is loaded by a process that is not part of a predefined list of legitimate system or application processes. The "BitsProxy.dll" is associated with the Background Intelligent Transfer Service (BITS) COM instance or API. Detecting its loading by uncommon processes can indicate suspicious activity, potentially related to adversaries abusing BITS for various purposes such as persistence, data transfer, or command and control.
This rule detects potential DLL sideloading by identifying the loading of specific system DLLs from non-standard, non-system locations. Adversaries often use DLL sideloading to execute malicious code by placing a malicious DLL in a directory where a legitimate application will load it instead of the intended system DLL. The rule includes a comprehensive list of DLLs commonly abused in sideloading attacks and filters out legitimate loads from known system directories to reduce false positives.
This rule detects when 'amsi.dll' is loaded by processes that are not commonly expected to load it. AMSI (Antimalware Scan Interface) is a Windows component that allows applications to integrate with installed antimalware products. Adversaries often attempt to bypass AMSI to execute malicious code without detection. This rule aims to identify such bypass attempts by flagging unusual process-AMSI.dll load combinations. The rule explicitly filters out common legitimate processes and directories that are known to load amsi.dll, such as explorer.exe, Sysmon64.exe, processes in Program Files, System32, SysWOW64, WinSxS, Windows Defender's MsMpEng.exe, and .NET framework related ngentask.exe processes.
This rule detects when known WMI-related modules are loaded by processes that are not typically associated with WMI operations. It specifically looks for the loading of DLLs such as 'fastprox.dll', 'wbemcomn.dll', 'wbemprox.dll', 'wbemsvc.dll', 'WmiApRpl.dll', 'wmiclnt.dll', 'WMINet_Utils.dll', 'wmiprov.dll', and 'wmiutils.dll'. The rule then filters out common legitimate processes that are known to load these WMI modules, including executables located in standard Windows directories (Program Files, System32, SysWOW64), .NET Framework paths, explorer.exe, and specific applications like WindowsAzureGuestAgent, WaAppAgent, Thor, Microsoft Defender's MsMpEng.exe, Microsoft Teams, and Sysmon. The intent is to identify potentially malicious use of WMI by uncommon or unexpected processes, which could indicate execution, persistence, or privilege escalation attempts.
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Detects the loading of specific DLLs associated with Katz Stealer malware, particularly variants from 2025. The presence and loading of these DLLs strongly indicate malicious activity on the system, as Katz Stealer is known for stealing sensitive information.
Page 51 of 56