Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Detects modifications to the 'LoadAppInit_DLLs' or 'RequireSignedAppInit_DLLs' registry values within the 'Windows NT\CurrentVersion\Windows' key. This technique is often used for persistence or to force-load a malicious DLL into processes that load user32.dll.
Detects specific DLLs associated with the BridgeHead tunneler (a tool attributed to the threat group Mirage Kitten) loading advapi32.dll. This dynamic loading behavior is consistent with the malware attempting to resolve and call the GetUserNameA function to verify the execution environment username, a technique commonly used to detect and evade automated sandbox analysis.
Detects coordinated EDR-blinding techniques where a process performs in-memory patching of AMSI (AmsiScanBuffer) or ETW (EtwEventWrite) while simultaneously executing direct syscalls to bypass standard ntdll.dll hooked exports. This combination is highly indicative of malicious activity attempting to evade endpoint security instrumentation.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects regsvr32 loading chromelevator.ocx/mscom.ocx followed by the ChromEggscalator credential-extraction command sequence.
Project CAV3RN
Cortex XDR
This rule monitors for indicators of compromise (IOCs) associated with a specific malicious activity or campaign, designated as 'Project CAV3RN'. It flags network communication with known malicious domains and IP addresses, as well as the execution or presence of specific file hashes and filenames (e.g., AzureCommunication.dll, logAzure.txt, NewProject.dll) related to the threat.
Detects the loading of 'lib.dll' by the 'msiexec.exe' process. This behavior is atypical and may indicate DLL hijacking or sideloading where a malicious library is loaded by the Windows Installer process.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Detects the loading of known TELEPUZ-specific DLLs into common Windows host processes (rundll32.exe and svchost.exe). TELEPUZ is known to perform ETW (Event Tracing for Windows) tampering by patching ntdll.dll functions during initialization, which is a technique used to suppress security telemetry.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Detects the loading of amsi.dll by rundll32.exe when invoked with specific command-line arguments. This pattern is associated with the TELEPUZ malware, which leverages this technique to patch the AmsiScanBuffer function in memory, effectively disabling AMSI (Antimalware Scan Interface) scanning for the process.
Detects instances where the executable 'pcl2bmp.exe' loads the DLL 'ctxmui.dll' from its own local directory. This behavior is indicative of potential DLL side-loading, where a legitimate application is used to load a malicious library by placing it in the same directory as the executable to influence the DLL search order.
Detects the 'beast.exe' process loading the 'RstrtMgr.dll' library. This behavior may be indicative of DLL side-loading, hijacking, or the execution of potentially malicious code masquerading as or interacting with system libraries.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Detects the loading of 'abe_decrypt.dll' into Google Chrome or Microsoft Edge browser processes. This behavior is highly irregular and often associated with browser-based malware, credential theft, or injection attempts to intercept browser data.
This rule detects a suspicious sequence of events where a device loads a specific DLL named 'n-ten.dll' and subsequently engages in high-volume network connection activity within a short time window. The rule alerts on endpoints that perform network scanning (defined by a threshold of distinct remote IPs or ports) shortly after the specified module load, which is a common behavior pattern for malicious payloads or backdoors initiating internal reconnaissance or lateral movement.
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
Detects the loading of DLLs by signed processes from suspicious, user-writable, or known staging directories associated with malware loaders like HijackLoader. The rule monitors for module load events involving paths such as AppData, ProgramData, and user profile subdirectories, while excluding known legitimate publishers and paths.
Page 11 of 33