Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,008 detections
Filters
Last updated
All Time
Detection languages
371
366
66
56
54
Contributors
191
187
115
105
103
Categories
471
263
245
169
116
Platforms
998
21
2
1
1
Products / Services
317
288
46
37
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,008
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects the multi-stage DLL sideloading technique used by the Nimbus Manticore APT group. This rule identifies when the legitimate Windows Defender component 'SenseSampleUploader.exe' loads 'xmllite.dll' from a non-standard directory, a behavior indicative of the group's novel DLL path hijacking method.
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
Detects when 'msimg32.dll' is loaded from a non-standard directory, which can be an indicator of DLL hijacking.
Detects potential DLL side-loading where the legitimate Palo Alto Networks executable 'PanGpHip.exe' is launched from a non-standard directory and loads 'libwaapi.dll' from the same path. This behavior is consistent with the technique described in the dmpdump report, where an LNK file executes the legitimate application to load a malicious DLL.
Detects the loading of `libcef.dll` by `vcpktsvr.exe` from non-standard directories. This specific DLL Sideloading behavior is a key tactic of the malware associated with the Termncolor/Colorinal malicious Python packages, where a legitimate executable is dropped into an unusual location to load a malicious DLL.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects the DLL sideloading of `jli.dll` by `java.exe` from common malware staging directories. This technique was observed being used by ReadNimeLoader as part of a BlackBasta-associated campaign.
This detection identifies suspicious DLL loads by SpeechRuntime.exe from outside the expected system directories. SpeechRuntime is vulnerable to a COM hijacking attack that allows an attacker to execute code remotely and stealthily by exploiting a Windows COM class. By altering the registry to point to a malicious DLL and then triggering the COM object, the attacker can cause the malicious DLL to load into SpeechRuntime.exe and execute in the user's context.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
Akira SonicWall Campaign - Detects the creation or presence of malicious drivers (hlpdrv.sys, rwdrv.sys) or the creation of their associated Windows services.
Detects malicious DLLs (ffmpeg.dll, libvlc.dll) used for sideloading by a China-nexus APT in the 'Illusory Wishes' campaign targeting the Tibetan community.
Detects the DLL sideloading of malicious DLLs (ffmpeg.dll, libvlc.dll) by legitimate applications (Element.exe, VLC.exe) as observed in the 'Illusory Wishes' campaign.
Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Page 39 of 48