Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.
Detects DLL side-loading attacks where consent.exe loads known malicious
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll)
from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to
load malicious payloads while appearing as a legitimate Windows UAC process. This rule requires Sysmon Event ID 7
(Image Load) to be enabled with proper DLL load monitoring. Recommended Sysmon configuration available in references.
Detects a DLL sideloading technique used by APT41 where the legitimate VipreAV executable 'vetysafe.exe' is used to load a malicious 'sbamres.dll'. This is a known method for deploying the Deed RAT.
Detects Sysmon Image Load events for shdocvw.dll or ieframe.dll by Office applications, which indicates the Shell.Explorer.1 or Internet Explorer component is being loaded. This is a direct indicator of CVE-2026-21509 exploitation as Office normally doesn't load these browser-related DLLs. The vulnerability specifically exploits the Shell.Explorer.1 COM object which relies on these DLLs for browser functionality within Office documents.
Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.
Detects the legitimate 'pdf24.exe' process loading 'cryptbase.dll' from a non-standard directory. This is indicative of a DLL side-loading attack, a technique used by the PDFSIDER malware to achieve execution and bypass security controls.
Detects when a legitimate application, such as pdf24.exe, loads 'cryptbase.dll' from a non-standard directory. This is a known DLL side-loading technique used by the PDFSIDER malware.
This rule detects suspicious DLL loads by the 'consent.exe' process. It specifically looks for known DLLs often abused in DLL side-loading or hijacking scenarios, such as 'msimg32.dll', 'version.dll', 'rtworkq.dll', 'wmsgapi.dll', and other DLLs containing 'sh4nya' or 'shanya' in their name. The rule excludes legitimate Microsoft versions of 'wmsgapi.dll' and 'msimg32.dll' based on their SHA1 hashes to reduce false positives. The 'consent.exe' process is associated with User Account Control (UAC) and its abuse can lead to privilege escalation or defense evasion.
Detects a specific DLL side-loading pattern used by APT37 in the "Operation Artemis" campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is dropped into the %TEMP% directory along with a malicious 'version.dll'. The legitimate process is then executed, causing it to load the malicious DLL.
Detects the DLL sideloading technique used by the Evasive Panda APT group, where the legitimate and signed 'evteng.exe' executable is used to load the malicious 'libpython2.4.dll'.
Detects the loading of a vulnerable version of WindowsCodecs.dll (related to CVE-2025-50165) by non-standard applications. This could indicate an attempt to exploit the vulnerability in a custom or unexpected application context.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects DLL side-loading techniques used by Project AK47 loaders. This involves legitimate executables like 7z.exe or clink_x86.exe loading malicious DLLs with similar names from the same directory.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
Detects potential exploitation of remote code execution vulnerability CVE-2025-33053 by monitoring suspicious image loads from WebDAV paths. The exploit involves malicious executables from attacker-controlled WebDAV servers loading Windows system DLLs like gdi32.dll, netapi32.dll, etc.
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process. This rule specifically looks for the arubanetsvc.exe process loading specific DLLs (wtsapi32.dll, msvcr100.dll, msvcp100.dll, dbghelp.dll, dbgcore.dll, wininet.dll, iphlpapi.dll, version.dll, cryptsp.dll, cryptbase.dll, wldp.dll, profapi.dll, sspicli.dll, winsta.dll, dpapi.dll) from a location other than the standard Windows system directories (C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This behavior is indicative of DLL Search Order Hijacking, where an attacker places a malicious DLL in a directory that is searched before the legitimate system DLLs, causing the application to load the malicious version.
Page 40 of 55