Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects an image load pattern as seen when a tool named PRIVATELOG is used and rarely observed under legitimate circumstances
Detects DLL sideloading activity seen used by Diamond Sleet APT
The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.
Detects DLL hijacking technique used by NOBELIUM in their FoggyWeb backdoor. Which loads a malicious version of the expected "version.dll" dll
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Detects potential DLL sideloading of Python DLL files.
Detects the "iscsicpl.exe" UAC bypass technique that leverages a DLL Search Order hijacking technique to load a custom DLL's from temp or a any user controlled location in the users %PATH%
Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)
Detects an uncommon process loading the "BitsProxy.dll". This DLL is used when the BITS COM instance or API is used.
This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.
This detection can be used to hunt for uncommon processes loading this DLL in your environment. Which may indicate potential suspicious activity occurring.
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential sideloading of malicious "aclui.dll" by OleView.This behavior was observed in Raspberry-Robin variants reported by chekpoint research on Feburary 2024.
Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Detects potential DLL sideloading of "SolidPDFCreator.dll"
Detects unsigned module load by ClickOnce application.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
This query looks for processes that load an older version of the system.management.automation libraries. While not inherently malicious, downgrading to PowerShell version 2
can enable an attacker to bypass some of the protections afforded by modern PowerShell. It is worth noting that some tools and scripts perform this to enable
backwards compatibility, so the technique is not inherently malicious. You will likely need to filter the processes within your environment that legitimately use this
capability for this to be effective.
can enable an attacker to bypass some of the protections afforded by modern PowerShell. It is worth noting that some tools and scripts perform this to enable
backwards compatibility, so the technique is not inherently malicious. You will likely need to filter the processes within your environment that legitimately use this
capability for this to be effective.
SCM DLL Sideload
Sigma
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism
Detects the Kapeka Backdoor binary being loaded by rundll32.exe.
The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In.
Page 46 of 55