Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
81 detections
Filters
Last updated
All Time
Detection languages
31
13
7
7
6
Contributors
20
15
11
7
5
Categories
37
21
13
12
11
Platforms
69
7
3
2
1
Products / Services
27
20
6
4
3
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects a malicious DLL component associated with SynkLoader, identified by specific exported functions (RunPowerShell, ExecutePowerShellCommand) and assembly metadata that facilitate executing PowerShell commands directly in memory.
Detects the use of a modified 'msvcp160.dll' associated with SynkLoader, specifically identifying exports related to manual DLL mapping ('ManualMapDLL', 'ManualResolveExport') and the accompanying Python loader script that utilizes 'ctypes.WinDLL' to perform in-memory execution.
The following analytic detects mpclient.dll, the Windows Defender client API library, being loaded by a process that is not part of the Windows Defender platform.
mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
mpclient.dll exposes the API surface used to drive on-demand Defender scans (IOAV, MpScan). In the ShieldBreak exploit, the attacker binary loads mpclient.dll directly and calls its scan APIs against an object-manager path in order to trigger a Defender scan against attacker-controlled content as part of a race condition targeting Defender's placeholder-hydration behavior.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
Detects the loading of unsigned .node files.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.
Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack.
.node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code.
This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects a process loading AzureCommunication.dll, the .NET Native AOT-compiled Outlook-calendar C2 module used by Project CAV3RN. The controller (uxtheme.dll) resolves this DLL's single export, QueryInterface, and passes it a get_;;_<agent-id>_,_<legacy-url> or
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
send_;;_<agent-id>_,_<legacy-url>_,_<result> command string to retrieve or exfiltrate data through Microsoft Graph calendar events. AOT compilation strips most managed metadata, making this an unusual DLL name/loading
pattern that has no legitimate purpose on a host.
Detects the modular ChonkyChicken plugin sequence: module_request/module_load C2 exchange, temp-file write, and LoadLibraryA load.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects the loading of non-standard, suspicious DLLs associated with modular plugin architectures or the execution of uxtheme.dll from non-standard, user-writable directories (e.g., Temp, AppData). This activity is characteristic of malware attempting to load malicious payloads via DLL search order hijacking or side-loading.
Detects an infostealer-style remote injection chain where a non-browser process allocates memory, writes a DLL path, and creates a remote thread pointing at kernel32!LoadLibraryW inside chrome.exe, msedge.exe, brave.exe, or firefox.exe. This suspend-inject-resume pattern is used by WEES Stealer to load its payload DLL into a browser process before intercepting App-Bound key material.
Detects the injection of code into an svchost.exe process from a non-system directory, followed by the loading of .NET CLR runtime modules (clr.dll, clrjit.dll, or mscorlib.ni.dll) within 5 minutes. This pattern often indicates an attempt to execute managed code inside a legitimate system process, potentially to evade security controls. The rule further enriches the finding by identifying if the svchost.exe process is running in a non-standard service group, which serves as a high-confidence signal of anomalous behavior.
Detects execution of potential BeepRAT loaders such as tcc.exe, luajit.exe, or hfy.exe that exhibit evasive behavior by loading amsi.dll. This activity is indicative of in-memory shellcode execution attempting to disable security features like AMSI, ETW, or WLDP before loading malicious payloads.
Detects instances where common Windows processes (explorer.exe, svchost.exe, dllhost.exe) load an unsigned module (DLL) from user-writable directories, such as AppData, Downloads, or Temp folders. This behavior is a common indicator of potential DLL sideloading or malicious code execution originating from user-controlled space.
Page 2 of 4