Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects loading of DLLs associated with Katz Stealer malware 2025 variants.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems.
The process that loads these DLLs are very likely to be malicious.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap.
Detects potential DLL sideloading of "chrome_frame_helper.dll"
Detects DLL sideloading of "dbgcore.dll"
Detects Clfs.sys being loaded by a process running from a potentially suspicious location. Clfs.sys is loaded as part of many CVEs exploits that targets Common Log File.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Loading unsigned image (DLL, EXE) into LSASS process
Detects potential DLL sideloading of "waveedit.dll", which is part of the Nero WaveEditor audio editing software.
Detects cmstp loading "dll" or "ocx" files from suspicious locations
Detects potential DLL sideloading of rcdll.dll
Detects potential DLL sideloading of an unsigned dbghelp.dll by the Sysinternals VMMap.
Detects a remote DLL load event via "rundll32.exe".
Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading.
Detects any GAC DLL being loaded by an Office Product
Detects windows utilities loading an unsigned or untrusted DLL.
Adversaries often abuse those programs to proxy execution of malicious code.
Adversaries often abuse those programs to proxy execution of malicious code.
Detects the load of EvtMuteHook.dll, a key component of SharpEvtHook, a tool that tampers with the Windows event logs
Detects the load of dbghelp/dbgcore DLL by a potentially uncommon or potentially suspicious process.
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.
The Dbghelp and Dbgcore DLLs export functions that allow for the dump of process memory. Tools like ProcessHacker, Task Manager and some attacker tradecraft use the MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Keep in mind that many legitimate Windows processes and services might load the aforementioned DLLs for debugging or other related purposes. Investigate the CommandLine and the Image location of the process loading the DLL.
Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.
This query was originally published in the threat analytics report, Solorigate supply chain attack. Please note that these attacks are currently known as the Nobelium campaign.
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query locates malicious Nobelium-associated DLLs that have been loaded into memory on affected systems.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
Microsoft detects the 2020 SolarWinds supply chain attack implant and its other components as part of a campaign by the Nobelium activity group. Nobelium is the threat actor behind the attack against SolarWinds, which was previously referred to as Solorigate.
Nobelium silently added malicious code to legitimate software updates for Orion, which is IT monitoring software provided by SolarWinds. In this way, malicious dynamic link libraries (DLLs) were distributed to SolarWinds customers.
The following query locates malicious Nobelium-associated DLLs that have been loaded into memory on affected systems.
More Nobelium-related queries can be found listed under the See also section of this document.
References:
https://msrc-blog.microsoft.com/2020/12/13/customer-guidance-on-recent-nation-state-cyber-attacks/
https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/
This query is looking for regsvr32.exe or rundll32.exe loading DLL images with other extensions than .dll.
Joins the data to public network events.
References:
https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/
Joins the data to public network events.
References:
https://threathunt.blog/running-live-malware-for-threat-hunting-purposes/
Page 47 of 55