Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects DLL sideloading patterns associated with OceanLotus (APT32) SPECTRALVIPER campaigns. The rule monitors for specific process masquerading using IntelAudioService.exe or various toolbox executable variants (Genuine.exe, Updater.exe, AutoCAD242.exe) accompanied by suspicious command-line arguments or the loading of the known malicious module DtlCrashCatch.dll.
This rule detects potential DLL sideloading of 'DtlCrashCatch.dll' by the 'IntelAudioService.exe' process, as well as the execution of 'IntelAudioService.exe' from suspicious user-profile directories with specific command-line arguments indicative of the SPECTRALVIPER malware execution chain.
Detects suspicious process behavior, memory modifications, and file loading associated with the SPECTRALVIPER threat actor. The rule monitors for remote thread creation, shellcode injection, and the loading of a specific malicious DLL named DtlCrashCatch.dll, often associated with IntelAudioService.exe process abuse.
Detects the execution of IntelAudioService.exe (a common masquerade for dtlupdate.exe) which loads a malicious DtlCrashCatch.dll from an AppModel StateRepository directory, a technique historically associated with the OceanLotus (APT32) threat actor.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects the creation or modification of files within the 'C:\ProgramData\Windows Multimedia' directory, a path associated with JFMBackdoor's screen capture output. The rule specifically monitors for this activity when initiated by 'fltMC.exe', which is known to be used by this malware for DLL side-loading.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects the loading of an unsigned DLL by 'quick_share.exe', 'NearbyShare.exe', or 'nearby_sharing.exe' from suspicious directory paths such as User Temp, AppData, or Downloads folders. This behavior is highly indicative of DLL side-loading attempts where an adversary leverages a legitimate, known process to execute malicious code.
Detects the loading of .NET assemblies (DLL, OCX, EXE) from user-writable directories such as AppData\Local\Temp or AppData\Roaming by processes that are not standard .NET development tools. This behavior is often associated with malware loaders, such as OXLOADER, that perform module stomping or use steganographic techniques to execute malicious code in memory via AppDomain.Load.
This rule detects potentially malicious activity involving the Windows binaries Regasm.exe and Regsvcs.exe, which can be abused to proxy the execution of arbitrary code. It specifically identifies three suspicious behaviors: spawning of common command shells or script engines by these binaries, execution of these binaries when located in or loading assemblies from user-writable directories (e.g., Temp, AppData, Downloads), and module loading of DLLs from those same writable locations, especially when the binary is not Microsoft-signed.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects the loading of .NET assemblies (mscorlib.dll, System.dll, System.Net.dll, System.IO.dll) by processes whose filenames start with 'GST' or contain 'Debit' or 'Invoice'. This pattern is indicative of the Remcos RAT loader attempting to execute without writing the assembly to disk, a technique often used to evade detection.
Detects the in-memory loading of 'Optimax.dll' and 'System Optimizer Ultimate.dll', which are identified as first and second-stage loaders respectively, associated with a steganographic Malware-as-a-Service (MaaS) delivery chain. This chain is known to drop Remcos RAT and other malware families. The rule also identifies related dropper processes based on internal file names 'TuglaInsaatci' and 'oacY.exe', and suspicious API calls indicative of process injection techniques like CreateRemoteThread and ProcessHollowing.
This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.
This rule monitors for suspicious process execution and module loading events, specifically targeting file paths and configurations associated with potential AppDomain Manager injection or masquerading techniques (e.g., PerfWatson2.exe, VMware tools, or Chrome setup configurations). It correlates Sysmon and Security event logs to detect known malicious patterns or abnormal file behaviors.
This rule detects processes that load 'amsi.dll' while concurrently performing suspicious memory or API activities often associated with AMSI bypass techniques, such as calling 'VirtualProtect' to change memory permissions or using API resolution functions like 'AmsiOpenSession', 'GetProcAddress', or 'GetModuleHandleA'. This pattern is commonly used by adversaries to disable or subvert the Antimalware Scan Interface.
This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.
Detects attempts to load critical system DLLs (ntdll.dll, kernel32.dll, user32.dll, advapi32.dll) from non-standard or suspicious file paths. This behavior can indicate an attempt to inject malicious code or evade detection by using modified or malicious versions of legitimate system modules.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
Page 22 of 33