Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
This rule monitors for the loading of 'avicap32.dll' by processes that are not typically associated with video or audio conferencing and recording. 'avicap32.dll' is a legacy Windows library used for capturing video, often abused by malware to secretly access webcams for surveillance purposes. By filtering out known legitimate applications (e.g., Zoom, Teams, OBS, Skype), this rule flags potential unauthorized access to video capture capabilities.
This rule detects post-click execution chains typical of RomulusLoader delivery, specifically identifying when browser or archive applications launch unsigned processes from user-writable directories (e.g., Downloads, Temp), or when a suspicious vulkan-1.dll module is sideloaded from these same directories.
Detects instances where a digitally signed executable loads a DLL file from a user-writable directory (e.g., AppData, Downloads, Temp). This is a common technique used by threat actors, such as in TA4922 campaigns, to execute malicious payloads (e.g., Atlas RAT or ValleyRAT) by sideloading them into a trusted process, effectively bypassing application allow-listing and environment security controls.
Detects processes attempting to load multimedia DLLs or access video capture devices that are not associated with authorized communication, media, or browser applications. This logic identifies potentially malicious attempts to capture video feeds from local cameras.
Detects unauthorized webcam usage by monitoring for the loading of avicap32.dll by non-standard processes. This behavior is indicative of the Atlas RAT, which leverages the avicap32 library to perform illicit video surveillance on compromised hosts.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects processes running from suspicious, writable directories (Temp, AppData, Downloads) that simultaneously load the .NET Common Language Runtime (clr.dll) and initiate network connections. This behavior is indicative of a downloaded binary or payload executing managed code to perform C2 communication.
Detects the loading of system drivers (.sys files) that are either unsigned or have an invalid digital signature. The rule excludes drivers loaded from common Windows system directories to minimize noise. This behavior is a common indicator of rootkit installation or the use of vulnerable drivers for kernel-mode exploitation.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
Detects DLL sideloading attempts associated with the Red Lamassu threat activity. The rule monitors for common Windows system binaries (odbcconf.exe, regsvr32.exe, rundll32.exe, and svchost.exe) loading DLL files from user-writable directories such as Temp, Downloads, AppData, and ProgramData, while filtering out legitimate loads from standard system paths.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects a suspicious multi-stage infection sequence associated with DcRAT, characterized by a process spawning a child with references to image files (.jpg/.jpeg), followed by the loading of an unsigned DLL from the same directory, and culminating in a TLS network connection within a narrow time window.
Detects unauthorized access to Windows Credential Manager files, TokenBroker OAuth cache files, or the loading of crypt32.dll from suspicious, user-writable directories (e.g., Temp, Downloads, Desktop) by non-Microsoft or non-system processes. This activity is indicative of credential theft, session hijacking, or attempts to abuse the Windows Data Protection API (DPAPI) to decrypt sensitive local secrets.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects behavior indicative of the Remcos RAT, specifically the use of the Windows Wave API or avicap32.dll for silent audio and webcam recording, followed by the persistence of recorded files in the C:\MicRecords directory.
Detects indicators associated with the deployment and execution of NetSupport RAT, including the launch of 'client32.exe', loading of the 'pcicl32.dll' module, outbound network connections, and the creation of the 'client.ini' configuration file. It also flags execution chains where 'client32.exe' is spawned by common browser or living-off-the-land processes.
Detects a suspicious sequence of events associated with the Operation DragonReturn DcRAT campaign. The rule monitors for the loading of amsi.dll followed by bcrypt.dll within a 5-minute window by specific processes (e.g., Mixed Reality.exe). This pattern is indicative of an AMSI in-memory bypass via AmsiOpenSession patching, followed by the decryption and loading of a .NET assembly, commonly used to maintain stealth during malware execution.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects suspicious behavior linked to the BeepRAT malware or related tooling (tcc.exe, LuaJit.exe). It monitors for the loading of GDI32 modules by these specific processes and identifies instances where these processes perform cross-process access to sensitive Windows system processes like explorer.exe or dwm.exe, which is indicative of process injection or defense evasion techniques.
Detects DLL sideloading activity attributed to the Mustang Panda group, where legitimate signed binaries such as Solid PDF Creator or Citrix Receiver are used to load potentially malicious DLLs (e.g., SHARDLOADER, MINIRECON, ZOHOMURK) from non-standard, user-writable directories including ProgramData, Public folders, and Temp directories.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Page 16 of 33