Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Detects the loading of known SparroWocky loader DLLs (winfsp-x64.dll or DukeQt.dll) into a process, followed by the absence of new executable file creation within the same process and time window. This behavior is indicative of in-memory execution techniques, such as Beacon Object File (BOF) loading, aimed at extending implant functionality without writing files to disk.
This rule detects the suspicious loading of known SparroWocky loader DLLs (winfsp-x64.dll or DukeQt.dll) into a process, followed by that same process loading graphics-related libraries (gdi32.dll, gdi32full.dll, or user32.dll) within a 10-minute window. This behavioral pattern is indicative of the backdoor's screen-capture capability, as these GDI/User32 modules are required for capturing screen content.
Detects a process loading known malicious DLLs (winfsp-x64.dll or DukeQt.dll) used by the FamousSparrow threat actor, followed by the creation or modification of a .dat file in the same process context. This pattern is indicative of the reflective loading of a backdoor payload without leaving the secondary binary on disk.
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Detects potential DLL side-loading attempts involving GlobalProtect VPN components. The rule identifies the execution of GlobalProtect.exe with specific command-line arguments combined with the presence of suspicious versions of bcrypt.dll or WININET.dll within the same directory, which are characteristic of recent malicious activity involving modified DLL files targeting GlobalProtect environments.
Detects code injection attempts targeting the Windows Media Network Sharing Service (wmpnetwk.exe), specifically monitoring for the loading of suspicious or common networking-related DLLs into this process. This behavior is indicative of an adversary attempting to mask malicious activity within a legitimate system process.
Detects suspicious thread injection activities (CreateRemoteThreadApiCall, NtCreateThreadEx, or RtlCreateThread) or the loading of 'ntdll.dll' by specific potentially unauthorized binaries (e.g., RuntimeSSH.exe, smqdservice.exe, etc.) or within the 'ProgramData\Microsoft\Windows\Telemetry' directory. This often indicates reflective code injection or process tampering, excluding known legitimate Windows system processes.
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
This rule monitors for suspicious memory-based code execution patterns, such as reflective loading or execution of code from memory segments marked with executable permissions (PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_READ) that do not originate from a signed Microsoft file. It specifically flags memory regions containing the MZ header that lack a corresponding backing file, as well as specific known suspicious DLL patterns or memory protection flag changes indicative of process injection or fileless execution.
This rule detects the presence or execution of known malicious DLL files (winfsp-x64.dll or DukeQt.dll) by monitoring process rollups, image loads, and file operations. The detection is triggered by matching the file name against specific SHA1 hashes associated with known malicious activity.
Detects the creation of threads where the entry point or call stack is associated with 'kernel32.dll' but originates from memory regions that are unbacked by a file on disk (i.e., 'unbacked', 'unknown') or have a null return address. This pattern is highly indicative of reflective code injection or manual shellcode execution, where an adversary attempts to execute code within a legitimate Windows process without a corresponding file-backed image.
This rule detects the loading of specific DLLs (winfsp-x64.dll or dukeqt.dll) by processes from locations outside of the standard Windows System32 or SysWOW64 directories. This behavior is indicative of DLL side-loading, where an adversary attempts to execute malicious code by placing a rogue DLL in a path where a legitimate application might attempt to load it, or by intentionally side-loading it alongside an executable.
Detects behavior indicative of the GRAYRABBIT malware, specifically identifying network connections to known command-and-control (C2) infrastructure (mail.uaiubifas.top) followed within a short time window (10 minutes) by reflective in-memory module loading activities within the same process. This pattern suggests the delivery and execution of a plugin or additional malicious payload without writing the binary to disk.
KQL Query from file: postgresql-server-executes-code-via-malicious-logical-decoding-plugin.kql
Detects activity where potential staging files (e.g., .dat or .dll files with specific naming patterns) are created or accessed within suspicious directories like AppData or RuntimeBroker folders, followed by the execution or loading of 'libcurl.dll'. This pattern is indicative of a loader or malware component staging its payload before using a network library to communicate with an external server.
Detects interactive or ad-hoc loading of the SCTP kernel module, which can be indicative of an adversary attempting to gain kernel-level persistence or capabilities. The rule excludes common system-initiated module loads from package managers and system service managers to reduce noise.
Page 7 of 33