Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

Detecting BYOVDLL Abuse

Steven Lim@KQLWizard

•updated Jul 1, 2025•5•0•78

KQL Query from file: Detecting BYOVDLL Abuse

Microsoft Sentinel (KQL)

Tags

T1036.005 - Match Legitimate Resource Name or Location T1070.004 - File Deletion T1218.011 - Rundll32 T1547.001 - Registry Run Keys / Startup Folder T1027 - Obfuscated Files or Information TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation T1574.001 - DLL T1128 - Netsh Helper DLL T1547.004 - Winlogon Helper DLL T1038 - DLL Search Order Hijacking T1574.008 - Path Interception by Search Order Hijacking T1055 - Process Injection T1659 - Content Injection T1587.002 - Code Signing Certificates M1045 - Code Signing T1036.001 - Invalid Code Signature TA0001 - Initial Access TA0011 - Command and Control TA0042 - Resource Development File Creation Driver Load File Event Windows Windows Defender Atpkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?