Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,008 detections
Filters
Last updated
All Time
Detection languages
371
366
66
56
54
Contributors
191
187
115
105
103
Categories
471
263
245
169
116
Platforms
998
21
2
1
1
Products / Services
317
288
46
37
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,008
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
Detects specific process characteristics of Winnti Pipemon malware reported by ESET
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.
Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Detects potential DLL sideloading of "SolidPDFCreator.dll"
Detects unsigned module load by ClickOnce application.
The analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment.
Detects specific process characteristics of Winnti Pipemon malware reported by ESET
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
SCM DLL Sideload
Sigma
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Detects potential DLL sideloading of "chrome_frame_helper.dll"
Detects DLL sideloading of "dbgcore.dll"
Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.
Page 42 of 48