Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,008 detections
Filters
Last updated
All Time
Detection languages
371
366
66
56
54
Contributors
191
187
115
105
103
Categories
471
263
245
169
116
Platforms
998
21
2
1
1
Products / Services
317
288
46
37
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,008
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
Suspicious GUP Usage
Sigma
Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
Tasks Folder Evasion
Sigma
The Tasks folder in system32 and syswow64 are globally writable paths.
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Detects potential DLL sideloading of "EACore.dll"
Detects potential DLL sideloading of "dbghelp.dll"
Detects potential DLL sideloading of "CCleanerReactivator.dll"
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications
Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded
Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL
Detects potential DLL sideloading of "AVKkid.dll"
Detects potential DLL sideloading of "wwlib.dll"
Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Detects DLL sideloading activity seen used by Diamond Sleet APT
The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential DLL sideloading of Python DLL files.
Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Page 41 of 48