Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
147 detections
Filters
Last updated
All Time
Detection languages
70
46
8
5
5
Contributors
27
22
18
16
13
Categories
44
44
26
22
16
Platforms
138
8
3
2
1
Products / Services
63
27
16
9
4
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
5
4
3
3
3
IDS Classtypes
4
IDS Protocols
2
1
1
Detects potential DLL sideloading where the legitimate Avira antivirus binary (avscan.exe) loads a custom DLL (avscan.dll) from user-writable directories such as AppData, Public, or ProgramData, potentially accompanied by a configuration file.
Detects DLL files written to user-writable profile folders (Desktop, Downloads, Documents and similar) on Windows endpoints. Attackers use these folders to stage a malicious DLL next to a legitimate executable, often from a phishing archive, so the executable loads it via DLL side-loading. Events are grouped by endpoint and path with DLL names, vendor, SHA-256 and the writing process. Installers and portable apps also match, so triage by hash, vendor, writing process and download source.
Detects ADNotificationManager.exe (Adobe Notification Manager) running from an unusual or unknown directory, which may be indicative of DLL Side-Loading. This binary has been observed being abused by multiple threat actors including GOLD BLADE to sideload malicious DLLs and deliver C2 payloads such as Havoc.
Detects modifications or creations of the SCNotification.exe.config configuration file associated with the Microsoft Endpoint Configuration Manager (SCCM/ConfigMgr) client by processes other than approved system tools such as ccmsetup.exe, msiexec.exe, or CcmExec.exe.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
This rule detects the suspicious sequential loading of 'tdwp.dll' and 'rnp.dll' by processes related to key management or encryption (e.g., 'rnpkeys.exe' or processes from a 'keyroll' folder). The detection correlates these events within a 2-minute window and highlights if the 'tdwp.dll' has a known malicious hash.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
Detects potential persistence attempts via registry modifications involving rundll32.exe. The rule monitors for two patterns: registry keys associated with shell commands for specific file types triggering rundll32.exe, and registry 'Run' keys using a 'Locked' value name with a custom URI handler, often indicative of malware or suspicious persistence mechanisms.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects instances where the Greenshot.exe application loads DLLs (log4net.dll, GreenshotPlugin.dll, LinqBridge.dll) from locations outside of the expected installation directory ('\Program Files\Greenshot' or '\Program Files (x86)\Greenshot'). The rule also tracks the creation of configuration or updater files ('greenshot-defaults.ini', 'updater.bat') which may be indicative of unauthorized modification, persistence, or potential DLL side-loading attempts.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Page 1 of 7