Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,008 detections
Filters
Last updated
All Time
Detection languages
371
366
66
56
54
Contributors
191
187
115
105
103
Categories
471
263
245
169
116
Platforms
998
21
2
1
1
Products / Services
317
288
46
37
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,008
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects dll-sideloading attempts via licensingdiag.exe
SPL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query
KQL Query
KQL Query
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking
Page 40 of 48