Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
160 detections
Filters
Last updated
All Time
Detection languages
68
58
9
8
6
Contributors
35
31
21
19
13
Categories
77
47
32
25
23
Platforms
156
1
1
1
Products / Services
58
43
17
9
4
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
7
1
1
1
1
IDS Classtypes
1
IDS Protocols
1
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
Detects modifications to the VSCode tasks.json configuration file by processes other than the VSCode editor itself. This activity can indicate an attempt to establish persistence or execute malicious code, as seen with malware like Miasma which alters this file to run malicious code during local builds.
Detects COM object hijacking via user registry CLSID entries for execution
This rule detects network traffic containing the string "HKCU\\Software\\Classes\\CLSID" on TCP port 135 (DCE/RPC) directed towards the home network. This pattern is indicative of an attempt to modify registry keys related to COM objects, which can be used for persistence or privilege escalation by hijacking COM object execution.
Detects registry modifications to the specific CLSID {722D0F89-B69C-4700-AE8C-4A44350E4876} utilized by the Argamal RAT's Stage 1 PowerShell script. This establishes initial persistence to later download and decrypt the final payload.
Detects COM hijacking of the Windows Color System Calibration Loader CLSID ({B210D694-C8DF-490D-9576-9E20CDBC20BD}). The Argamal RAT abuses this specific CLSID by modifying the InprocServer32 key in the user hive to establish startup persistence tied to user login via a default Windows scheduled task.
Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, used by Argamal RAT for persistence. Legitimate Windows Color System components are typically registered in HKLM, not HKCU.
Detects modification of the InprocServer32 key for the Windows Color System Calibration CLSID, a persistence mechanism actively abused by the Argamal RAT to establish startup persistence tied to user login via a default Windows scheduled task.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects instances where dllhost.exe, which typically hosts COM objects, spawns suspicious child processes such as command shells, scripting interpreters, or reconnaissance tools. This behavior is highly indicative of COM object hijacking, process injection, or DCOM lateral movement with hands-on-keyboard activity.
This rule detects instances where 'dllhost.exe' is spawned by a parent process other than 'services.exe' or 'svchost.exe'. Dllhost.exe is typically used to host COM+ applications and should almost exclusively be initiated by these legitimate system processes. An unusual parent could indicate COM object hijacking, lateral movement, or process injection attempts.
Detects potential COM hijacking used by Sednit (APT28) malware like BeardShell and SlimAgent for persistence. This involves modifying InprocServer32 registry keys to point to malicious DLLs.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects the creation of files with an imphash associated with UKC-1230 (Comburglar) malware. This imphash is a high-fidelity indicator for the surrogate DLLs used in their COM hijacking persistence technique.
Detects the creation of DLL files named with a GUID pattern in common staging directories. This technique was observed being used by the threat actor UKC-1230 to drop surrogate COM DLLs for persistence.
Detects suspicious registry writes that change the BitLocker BDEUILauncher CLSID {A7A63E5C-3877-4840-8727-C1EA9D7A4D50} InProcServer32 DLL away from fveui.dll, consistent with BitlockMove-style COM/DCOM hijacking lateral movement.
Detects a specific COM hijacking technique used by the ForumTroll APT group for persistence. This rule identifies registry modifications to the CLSID {1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}, which the group has reused across campaigns.
Detects COM object hijacking via TreatAs subkey
Detects potential COM object hijacking via modification of default system CLSID.
Detects the creation of a specific COM object registry key in the HKEY_CURRENT_USER hive to hijack the legitimate 'twinapi.dll' component. This persistence technique (T1546.015) was used by the ForumTroll APT group to load the LeetAgent and Dante spyware.
Detects Component Object Model (COM) hijacking used by the ForumTroll APT group for persistence. This rule identifies modifications to the registry where a malicious DLL is registered to be loaded by legitimate processes by overriding the CLSID for twinapi.dll in the HKEY_CURRENT_USER hive.
Page 5 of 8