Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects the loading of WSMAN provider DLLs by processes other than the expected svchost.exe, or by svchost.exe with an unexpected original filename. This can indicate local or remote execution using Windows Remote Management (WinRM) or Windows Management Instrumentation (WMI) for lateral movement or execution, potentially by an attacker.
This rule detects the loading of the 'vssapi.dll' library by executables that are not commonly associated with legitimate Volume Shadow Copy operations. Adversaries often interact with Volume Shadow Copy Service (VSS) DLLs to delete shadow copies, which is a common technique to inhibit system recovery and prevent data restoration after ransomware attacks or data destruction.
The analytic detects a process loading the `credui.dll` or `wincredui.dll` module. This detection leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes outside typical system directories. This activity is significant because adversaries often abuse these modules to create fake credential prompts or dump credentials, posing a risk of credential theft. If confirmed malicious, this activity could allow attackers to harvest user credentials, leading to unauthorized access and potential lateral movement within the network.
Detects the image load of 'vsstrace.dll' by executables that are not typically associated with legitimate Windows operations or known backup solutions. This behavior can indicate an adversary attempting to manipulate or delete Volume Shadow Copies, often as a precursor to data encryption for impact (ransomware) or to hinder system recovery.
Detects the creation of a scheduled task that launches an executable from a non-standard, writable directory, which subsequently loads a co-located DLL. This pattern is a form of DLL Sideloading used for persistence and was observed in a ToddyCat APT attack.
Detects WMI command line event consumers
The analytic detects instances where a Dynamic Link Library (DLL) is loaded from a temporary directory on a Windows system. Loading DLLs from non-standard paths such as %TEMP% is uncommon for legitimate applications and is often associated with adversary tradecraft, including DLL search order hijacking, side-loading, or execution of malicious payloads staged in temporary folders. Adversaries frequently leverage these directories because they are writable by standard users and often overlooked by security controls, making them convenient locations to drop and execute malicious files. This behavior may indicate attempts to evade detection, execute unauthorized code, or maintain persistence through hijacked execution flows. Detection of DLL loads from %TEMP% can help surface early signs of compromise and should be investigated in the context of the originating process, user account, and potential file creation or modification activity within the same directory.
This detection identifies unsigned DLLs loaded through DLL side-loading where the DLL shares the same file path as the process that loaded it. This technique is observed in malware like DarkGate and PlugX. The rule monitors DLL loading events, verifies digital signatures, and flags unsigned DLLs. It specifically excludes DLLs loaded from standard Windows system directories and Program Files to reduce false positives. Detecting such suspicious DLLs is crucial in preventing privilege escalation and other security breaches.
Detects potential DLL sideloading of DLLs that are part of antivirus software such as McAfee, Symantec, Bitdefender, F-Secure, CyberArk, Avast, ESET, and Trend Micro. The rule identifies when specific DLLs associated with these security products are loaded from an unexpected or non-standard directory, indicating a possible attempt to hijack the execution flow.
A DefenderXDR Custom Detection for CVE-2025-56383
Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. The rule filters out legitimate loads from common installation paths and specific applications like Eclipse.
Detects when essential PowerShell DLLs, specifically 'System.Management.Automation.dll', are loaded by processes that are not legitimate PowerShell executables. This behavior can indicate malicious activity, such as an attacker using techniques like meterpreter's 'load powershell' extension or PowerShdll to execute PowerShell commands in a stealthy manner without directly invoking powershell.exe.
Detects potential DLL sideloading of 'dbgcore.dll' by identifying instances where this DLL is loaded from non-standard or unexpected file paths. This technique can be used by adversaries for defense evasion, persistence, and privilege escalation.
Detects Windows utilities loading an unsigned or untrusted DLL. Adversaries often abuse these programs to proxy execution of malicious code, bypassing application control and potentially evading detection. The rule specifically targets `InstallUtil.exe`, `RegAsm.exe`, `RegSvcs.exe`, `regsvr32.exe`, and `rundll32.exe` when they load DLLs that are not signed or have an invalid signature status. It includes filters for common legitimate scenarios to reduce false positives.
Detects the loading of 'Amsi.dll' by specific Living Off the Land Binaries (LOLBINs) such as ExtExport.exe, odbcconf.exe, and rundll32.exe. This activity can indicate an attempt to bypass Antimalware Scan Interface (AMSI) protections, often associated with 'PowerShell without PowerShell' attacks where malicious scripts are executed without directly invoking powershell.exe.
Detects potential DLL sideloading of "dbghelp.dll" by identifying instances where this DLL is loaded from a non-standard or unexpected directory. This technique can be used by adversaries for defense evasion, persistence, or privilege escalation.
Detects probable exploitation of the reported Notepad++ plugin DLL hijack by correlating DLL loads from Notepad++\plugins with recent file changes or swap-style renames, prioritising user-writable locations (Users/AppData/OneDrive) and weak trust. Outputs a Verdict and SuspicionScore for quick triage.
Detects the loading of a malicious 'pc2msupp.dll' via legitimate applications, a technique used by Naikon and BackdoorDiplomacy groups to load RainyDay, Turian, and a new PlugX variant.
This rule detects when a non-Python process loads the "Python Core" image. This behavior is often indicative of an executable that has been bundled from Python code using tools like Py2Exe, PyInstaller, or cx_Freeze. Threat actors commonly use these tools to package malicious Python scripts into standalone executables, which can help obfuscate their code or bypass security measures. The rule filters out legitimate Python processes and common installation paths to reduce false positives.
Detects when the Microsoft Management Console (MMC) loads scripting engine DLLs such as vbscript.dll, jscript.dll, or jscript9.dll. This activity can indicate an attempt to execute malicious scripts within a trusted system process, potentially for bypassing application whitelisting or defense evasion.
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
Page 43 of 55