Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects reconnaissance activities aimed at identifying c-ares library linkage using tools like ldd, readelf, and strings, or via pattern matching in files. It also monitors for the suspicious loading of cares.dll outside of expected vendor directories and the execution of specific files identified as part of a c-ares TCP use-after-free proof-of-concept.
Detects the SNOWLIGHT dropper executing or loading modules as 'wusvc.exe' (a common masquerading name) from a user Downloads directory. This behavior is indicative of a reconnaissance phase where the dropper attempts to resolve 'GetUserNameA' from 'advapi32.dll' to identify the current system user.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects core indicators of Grixba malware, including the persistence path of GT_NET.exe in the Public Music directory, the loading of the associated malicious CoreScanner module (inf_g.dll), staging of reconnaissance output files, and the use of GT_NET.exe to perform network lateral movement via WMI/WinRM ports.
This rule detects the suspicious behavior where the process 'MpExtMs.exe' loads the 'EndpointDlp.dll' library into memory without any corresponding file creation or modification events for that DLL. This pattern is indicative of reflective code loading or fileless execution techniques often associated with Backdoor.Mistic (MLTBackdoor), where malicious code is executed directly from memory to evade disk-based security controls.
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
Cloud extortion group exploiting exposed credentials and storage
Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.
Detects the loading of amsi.dll by processes frequently associated with PyInstaller or potential AMSI patching attempts. This rule monitors EventCode 7 (ImageLoad) events specifically identifying instances where amsi.dll is loaded by processes containing '_mei' (a common temporary directory prefix for PyInstaller), python executables running from temporary directories, or processes named 'winupdate.exe'. Such activity is often observed during the execution of obfuscated or packaged malicious binaries attempting to disable or bypass AMSI (Antimalware Scan Interface).
This rule detects potential DLL sideloading by identifying instances where a process executing from a user-writable path (e.g., \Users, \ProgramData, \Temp) loads a DLL that resides in the same directory. This pattern is commonly associated with malicious payloads delivered via phishing archives where a legitimate binary and a malicious DLL are placed in the same folder to facilitate sideloading.
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Detects malicious artifacts and behaviors associated with TA4922 (Atlas RAT, SilentRunLoader, RomulusLoader), including known malicious file hashes, DLL sideloading patterns masquerading as legitimate graphics libraries, and unauthorized execution of Python interpreters from user-writable directories.
Detects the loading of the 'avicap32.dll' (Video Capture API) module by processes that are not recognized as legitimate media, conferencing, or streaming applications. This behavior is often associated with remote access tools (RATs) like Atlas RAT, which may use this library to covertly capture video from a webcam.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects instances where QEMU-related binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, or ADNotificationManager.exe) load modules from locations other than the standard Windows system directories or the authorized QEMU installation directory. This behavior is indicative of potential DLL side-loading or hijacking attempts, where a malicious DLL is placed in the same directory as the executable to be loaded by the application.
Detects the specific pattern of ADNotificationManager.exe loading the vcruntime140_1.dll, which is a known indicator of DLL side-loading used in the Gold Encounter attack chain.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects the loading of unsigned or improperly signed DLLs by high-value/legitimate Windows binaries (e.g., mmc.exe, OneDrive.exe, teams.exe, rundll32.exe) from user-writable directories such as AppData, Temp, Downloads, or ProgramData. This behavior is indicative of DLL search-order hijacking or DLL side-loading, often used by adversaries to execute malicious code within the context of trusted applications.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
Page 21 of 33