Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,440
11,814
5,871
5,145
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects the UAC-0226 WC3 PowerShell loader script which utilizes .NET reflection to resolve native NT APIs for the reflective injection of the GIFTEDCROOK payload into memory. The loader exhibits behavioral indicators such as file staging in ProgramData, sandbox evasion via sleep commands, and the definition of RWX memory permissions.
Detects the Chromelevator loader (drun.exe) performing reflective injection of an encrypted payload DLL into a remote process using direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR hooks. Also detects the spawned vt-windows-event-stream.exe helper process.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects the loading of .NET assemblies (mscorlib.dll, System.dll, System.Net.dll, System.IO.dll) by processes whose filenames start with 'GST' or contain 'Debit' or 'Invoice'. This pattern is indicative of the Remcos RAT loader attempting to execute without writing the assembly to disk, a technique often used to evade detection.
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
This rule detects potentially malicious usage of rundll32.exe by monitoring for specific command-line indicators associated with APT28, as well as the execution of DLL files from commonly abused directories like Temp, tmp, or ProgramData.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
Detects the OXLOADER malware dropping a malicious copy of dui70.dll renamed as a random .ocx file into the user's temporary directory. The rule identifies subsequent loading of this dropped file via LoadLibraryA, which is indicative of module stomping techniques where malicious code in an added .xtext section is executed within the context of a legitimate system component.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
Detects unusual DLL loads associated with the VirtualBox DbgView64.exe process, potentially indicating the DLL sideloading technique used to inject the Backdoor.Turn RAT.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
This rule detects processes accessing or loading specific files (such as .mui, .dat, .nls, and .etl files) that are associated with specific naming conventions (xwreg, xgdf) or locations often targeted by malicious DLL search order hijacking or masquerading attempts. By identifying files that mimic or occupy paths related to system resources, the rule aims to uncover activity indicative of persistence or evasion techniques.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
This rule detects the execution of SharkLoader components, specifically identifying unauthorized SystemSettings.exe processes attempting to load malicious DLLs (e.g., SystemSettings.dll, DscCoreR.mui, SyncRes.dat) from locations outside of the legitimate C:\Windows\ImmersiveControlPanel\ directory. It also tracks the creation or modification of these payload files in common persistence directories like AppData or ProgramData.
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
Detects the loading of suspicious DLLs and support files (e.g., systemsettings.dll, dsccorer.mui, syncres.dat, msedge.dll) from atypical AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates these file loads with known MD5 hashes associated with Sharkloader, indicating potential malicious payload execution or side-loading activities.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
The detection monitors for the loading of specific files ('SyncRes.dat' or 'DscCoreR.mui') that are known to be used as side-loading targets for malicious DLLs. These file names are frequently associated with various malware campaigns leveraging DLL search order hijacking to execute malicious code within the context of trusted applications.
Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.
Page 24 of 33