SigmaHQ Detections
@sigmaHQ12 followers122,473 downloads2,593 copies16 likes160,496 views
6,800 detections
Filters
Last updated
All Time
Detection languages
6,800
Categories
2,695
910
506
407
372
Platforms
5,315
505
263
204
164
Products / Services
2,051
1,570
475
423
316
MITRE Techniques
2,652
1,739
1,656
1,503
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of Python DLL files.
Detects potential DLL sideloading of rcdll.dll
Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects potential DLL sideloading of "vivaldi_elf.dll"
Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Page 109 of 680