Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects the load of advapi31.dll by a process running in an uncommon folder
PowerShell Execution
Sigma
Detects execution of PowerShell
Detects DLL load activity of known compromised DLLs used in by the compromised 3CXDesktopApp
Hunts known SVR-specific DLL names.
Detects potential CSharp Streamer RAT loading .NET executable image by using the default file name and path associated with the tool.
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects CLR DLL being loaded by an Office Product
Detects the image load of vss_ps.dll by uncommon executables
Detects both of CVE-2022-30190 (Follina) and DogWalk vulnerabilities exploiting msdt.exe binary to load the "sdiageng.dll" library
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Detects potential DLL sideloading of "appverifUI.dll"
Detects potential DLL sideloading of "MpSvc.dll".
Detects PowerShell core DLL being loaded by an Office Product
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc).
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Detects WMI command line event consumers
Detects potential DLL sideloading of "CCleanerDU.dll"
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Page 48 of 55