Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,008 detections
Filters
Last updated
All Time
Detection languages
371
366
66
56
54
Contributors
191
187
115
105
103
Categories
471
263
245
169
116
Platforms
998
21
2
1
1
Products / Services
317
288
46
37
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,008
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the use of the PhoneDeepLink parameter to potentially sideload a DLL file that does not exist. This non-existent DLL file is named "ShellChromeAPI.dll".
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects potentially suspicious child processes of KeyScrambler.exe
Detects the execution of Xwizard tool from a non-default directory.
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
When executed from a non-default directory, this utility can be abused in order to side load a custom version of "xwizards.dll".
Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, which can be used to execute code in context of the DHCP server (restart required)
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Detects potential DLL sideloading of "appverifUI.dll"
Detects potential DLL sideloading of "MpSvc.dll".
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Detects potential DLL sideloading of "CCleanerDU.dll"
Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser.
An attacker can use this to authenticate to Azure AD in a browser as that user.
An attacker can use this to authenticate to Azure AD in a browser as that user.
Detects potential DLL sideloading of "edputil.dll"
Detects potential DLL sideloading of "vivaldi_elf.dll"
Attempts to load dismcore.dll after dropping it
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"
Page 44 of 48