Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
81 detections
Filters
Last updated
All Time
Detection languages
31
13
7
7
6
Contributors
20
15
11
7
5
Categories
37
21
13
12
11
Platforms
69
7
3
2
1
Products / Services
27
20
6
4
3
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the OXLOADER malware attempting to probe for sandbox or analysis environments by dynamically loading mpr.dll and invoking the WNetAddConnection2W API function. This activity is a known behavioral pattern used to identify system artifacts or network connectivity constraints indicative of security analysis environments.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
This rule detects the presence of the string "ReflectiveLoader" within HTTP response bodies. This string is commonly associated with Reflective DLL Injection techniques, where a malicious DLL is loaded directly into a process's memory without being written to disk. The detection is case-insensitive and focuses on traffic flowing from the server to the client.
This rule detects attempts to load a DLL module from a remote network path over SMB. It specifically looks for traffic on port 445 (SMB) containing both ".dll" and "\\" (indicating a network path) in a case-insensitive manner. This behavior is often associated with trojan activity or other forms of malicious execution where an attacker might try to load a malicious DLL from a shared network drive.
Detects the creation of a new MariaDB User-Defined Function (UDF) that loads a shared object (.so or .dll) file. This technique is used in the final stage of the CVE-2026-32710 attack chain to execute arbitrary OS commands, often from suspicious temporary or public directories.
Detects suspicious modules loaded by taskhost.exe or taskhostw.exe, which is a known execution guardrail for the BeardShell implant used by Sednit (APT28).
Detects PowerShell scripts that dynamically define Win32 APIs (e.g., OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) using the Add-Type cmdlet. This technique, observed in the Dead#Vax campaign, allows attackers to perform process injection in a fileless manner by loading and invoking native functions from within PowerShell.
Detects DLL side-loading activity associated with the Silver Fox APT, where the legitimate Thunder.exe application is executed from a temporary directory to load a malicious, unsigned libexpat.dll.
This rule detects the loading of unsigned or untrusted DLLs from suspicious, non-standard file paths into a set of common Windows processes. It correlates DLL load events with recent process executions to identify potentially malicious shared module usage, often indicative of DLL hijacking or side-loading techniques. The rule specifically looks for DLLs loaded from paths like \Users\Public\, \Temp\, \AppData\, \ProgramData\, \Downloads\, and \PerfLogs\, into processes such as explorer.exe, svchost.exe, lsass.exe, and common applications like chrome.exe or winword.exe. It then filters these events to only include DLLs that are either unsigned or untrusted, and whose signer is not part of a predefined list of trusted entities (e.g., Microsoft, Google).
This rule detects the use of the CreateRemoteThread API in conjunction with the LoadLibrary function to inject a DLL into another process. Specifically, it looks for events where a remote thread is created, the starting module is 'kernel32.dll', and the starting function is 'LoadLibraryA'. This combination is a common technique for dynamic-link library (DLL) injection, often used by malware to execute arbitrary code within the context of a legitimate process, evade defenses, and potentially elevate privileges.
This analytic identifies instances where executable files (.exe) are loaded as modules, detected through 'ImageLoaded' events in Sysmon logs. This method leverages Sysmon EventCode 7 to track unusual module loading behavior, which is significant as it deviates from the norm of loading .dll files. This activity is crucial for SOC monitoring because it can indicate the presence of malware like NjRAT, which uses this technique to load malicious modules. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and further compromise the host system.
Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.
Detects loading of DLLs associated with Katz Stealer malware 2025 variants.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Detects the loading of specific DLLs associated with Katz Stealer malware, particularly variants from 2025. The presence and loading of these DLLs strongly indicate malicious activity on the system, as Katz Stealer is known for stealing sensitive information.
This analytic detects potential credential dumping by identifying specific GrantedAccess permission requests and CallTrace DLLs targeting the LSASS process. It leverages Sysmon EventCode 10 logs, focusing on access requests to lsass.exe and call traces involving debug and native API DLLs like dbgcore.dll, dbghelp.dll, and ntdll.dll. This activity is significant as credential dumping can lead to unauthorized access to sensitive credentials. If confirmed malicious, attackers could gain elevated privileges and persist within the environment, posing a severe security risk.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.
Detects the use of PowerShell's 'Import-Module' cmdlet to load the 'Microsoft.ActiveDirectory.Management.dll'. This DLL is part of the Active Directory module and is frequently used by attackers for Active Directory enumeration, especially in environments where RSAT (Remote Server Administration Tools) might not be installed or administrative privileges are not initially present.
Page 4 of 4