Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.
This rule detects potential DLL sideloading of "edputil.dll". It specifically looks for instances where "edputil.dll" is loaded from a directory that is not a standard Windows system directory (C:\Windows\System32\, C:\Windows\SysWOW64\, or C:\Windows\WinSxS\). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of the legitimate one.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.
Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. This technique can be used for persistence, defense evasion, and privilege escalation.
This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Detects processes loading a Lua library (DLL), which could indicate the execution of an embedded Lua script for post-exploitation. This technique was demonstrated in the LOLMIL (Living Off the Land Models and Inference Libraries) research where an autonomous malware used an embedded Lua interpreter to run dynamically generated code.
The following analytic detects the loading of DLL modules associated with the GraphicalProton backdoor implant, commonly used by SVR in targeted attacks. It leverages Sysmon EventCode 7 to identify specific DLLs loaded by processes. This activity is significant as it may indicate the presence of a sophisticated backdoor, warranting immediate investigation. If confirmed malicious, the attacker could gain persistent access to the compromised host, potentially leading to further exploitation and data exfiltration.
Detects BitLocker Access Agent Update Utility (baaupdate.exe) loading DLLs from suspicious, publicly writable locations. This activity could indicate an attempt at lateral movement via BitLocker DCOM & COM Hijacking, abusing the BDEUILauncher Class to execute code in the logged-on user's session without credential theft.
Page 42 of 55