Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
Detects instances where suspicious processes load the amsi.dll module, which is a common precursor to performing in-memory patching of the AmsiScanBuffer function. This behavior is indicative of an attempt to disable Anti-Malware Scan Interface (AMSI) to evade security scanning, specifically observed in techniques like the SNOWLIGHT dropper.
Detects the loading of amsi.dll by a non-Microsoft signed process. This behavior is indicative of processes attempting to hook or patch AMSI (Antimalware Scan Interface) functions in memory to evade detection, a technique commonly used by malware droppers to neutralize security scanning.
Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
Detects InstallService.exe loading the InstallServicePlugin.dll from a remote UNC path. This behavior is associated with the UnCanny Coercion technique, which exploits a vulnerability in the Windows Installer service to load arbitrary DLLs from remote shares.
Detects MsBuild.exe loading memory-resident .NET assemblies post-hollowing.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
Detects attempts to load the 'mscoree.dll' library by processes like PowerShell, setup, or main executables. This activity can indicate an in-memory .NET assembly load, often used by adversaries for stealthy execution (T1620).
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
Identifies a signed binary associated with Fox Tempest loading an unsigned, anomalous DLL from the same directory, specifically from common user-writable directories like Downloads, Temp, or AppData. This behavior is indicative of DLL side-loading for defense evasion or privilege escalation.
Detects the loading of amsi.dll by specific suspicious executable names, which may indicate an attempt to interact with or bypass the Antimalware Scan Interface (AMSI).
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
Detects the loading of amsi.dll in conjunction with command-line arguments that reference sensitive APIs often used to patch or disable the Antimalware Scan Interface (AMSI), such as VirtualProtect, GetProcAddress, or BCrypt-related functions.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Page 25 of 33