Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Detects the execution of known legitimate QEMU binaries (qemu-system-x86_64.exe, qemu-system-i386.exe) and ADNotificationManager.exe from non-standard, user-writable, or attacker-controlled staging directories. This behavior is indicative of DLL sideloading attacks, where adversaries place malicious DLLs alongside these binaries to achieve code execution.
Detects DLL sideloading behavior by the threat group OceanLotus (APT32), specifically targeting instances where legitimate Autodesk or HP Toolbox executables (Genuine.exe, Updater.exe, AutoCAD242.exe) are executed with the -uiDll command-line flag. This technique is used to load malicious DLLs (referred to as SPECTRALVIPER) from masqueraded, non-standard file paths such as %LOCALAPPDATA%\Autodesk or C:\Windows\appcompat, facilitating persistence and execution.
Detects the execution of IntelAudioService.exe (a common masquerade for dtlupdate.exe) which loads a malicious DtlCrashCatch.dll from an AppModel StateRepository directory, a technique historically associated with the OceanLotus (APT32) threat actor.
Detects OceanLotus (APT32) activity utilizing DLL sideloading by executing renamed variants of Toolbox.exe (e.g., AutoCad242.exe, Genuine.exe, Updater.exe) with the '-uiDll' command-line flag to load masqueraded payloads with extensions like .json, .conf, or .log.
This rule detects potential DLL sideloading activity linked to the threat group OceanLotus (APT32). It specifically monitors for the execution of 'IntelAudioService.exe' with specific arguments indicative of loading the SpectralViper implant, as well as the execution of known legitimate but abused binaries (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' command-line flag to load malicious DLLs.
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
Detects instances where the Windows process DllHost.exe creates executable or script files in suspicious user-writable directories (e.g., Temp, Public, ProgramData). This behavior is often indicative of WSL2 (Windows Subsystem for Linux) interacting with the Windows host filesystem, where a Linux-based process may attempt to stage payloads on the Windows partition via the WSL2 interop mechanism.
Detects instances where the DllHost.exe process writes new executable files (e.g., .exe, .dll) or script files (e.g., .ps1, .vbs) to common staging locations such as C:\Users\Public, C:\Windows\Temp, or C:\ProgramData. This behavior is indicative of potential malware delivery or stage-two payload execution.
Detects instances where the DllHost process (COM Surrogate) writes executable files, scripts, or library files to common temporary or user-writable directories. This behavior is often associated with fileless or masqueraded execution techniques where attackers use legitimate system binaries to drop malicious payloads.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
Detects instances where the DllHost.exe process creates files with executable-like extensions (exe, dll, ps1, bat, cmd, vbs, hta, scr) within high-risk, world-writable directories such as C:\Users\Public, C:\Windows\Temp, C:\ProgramData, C:\Users\Default, or AppData\Local\Temp. This behavior is often indicative of malicious activity, such as file drops for further execution or persistence, as legitimate COM surrogate activity rarely results in file creation in these specific locations.
Detects signs of JDY botnet activity on Linux systems, specifically identifying shell-based payload downloads using curl or wget, or the execution of binaries directly from temporary directories, a pattern common in IoT firmware compromises.
Detects the execution of fltMC.exe from temporary directories (%TEMP% or %TMP%). This behavior is associated with the Red Lamassu JFMBackdoor campaign, where fltMC.exe is used to facilitate DLL sideloading by staging required files (fltMC.exe, FLTLIB.dll, flt.bin, and scr.mui) in the temporary folder.
Detects the co-occurrence of JFMBackdoor DLL sideloading via fltMC.exe and an additional PlugX DLL sideloading event originating from a temporary directory on the same host. This pattern is indicative of the Red Lamassu actor group deploying shared tooling for lateral movement and persistence.
Detects execution of fltMC.exe when located in the Temp directory, or execution of processes matching known malicious file hashes associated with this filename.
Page 68 of 80