Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,439
11,829
5,873
5,151
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Page 56 of 56