Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects potential DLL sideloading of "CCleanerDU.dll" when loaded by an executable that is not the legitimate CCleaner application (CCleaner.exe or CCleaner64.exe) or is not located in the standard CCleaner installation paths.
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
This rule detects potential DLL sideloading of "chrome_frame_helper.dll". It triggers when "chrome_frame_helper.dll" is loaded from a location other than the legitimate Google Chrome application directories (C:\Program Files\Google\Chrome\Application\ or C:\Program Files (x86)\Google\Chrome\Application\) or the user's local AppData path for Chrome.
Detects potential DLL sideloading using comctl32.dll by monitoring specific Windows executables loading this DLL from a '.local' directory, which is a common technique for privilege escalation and defense evasion.
This rule detects potential DLL sideloading attempts involving specific third-party software DLLs. It identifies when 'commfunc.dll' (associated with Lenovo software) or 'tosbtkbd.dll' (associated with Toshiba Bluetooth software) are loaded from unexpected or non-standard paths. The rule aims to catch instances where an attacker might place a malicious DLL with the same name in a location that a legitimate application will load before its intended, legitimate DLL, thereby achieving execution, persistence, privilege escalation, or defense evasion.
This rule detects potential DLL sideloading attempts targeting DLLs associated with the Wazuh security platform. Specifically, it looks for `libwazuhshared.dll` or `libwinpthread-1.dll` being loaded from locations outside of standard program file directories (e.g., `C:\Program Files\` or `C:\Program Files (x86)\`). It also filters out common legitimate loads of `libwinpthread-1.dll` from `AppData` or `ProgramData` within `mingw64` paths.
This rule detects potential DLL sideloading of 'libvlc.dll'. Adversaries may place a malicious 'libvlc.dll' in a directory that is searched before the legitimate VLC installation path, causing a legitimate application to load the malicious DLL instead of the intended one. This technique can be used for defense evasion, persistence, and privilege escalation. The rule specifically looks for 'libvlc.dll' being loaded from any location other than the default VLC installation directories.
This rule detects potential DLL sideloading of an unsigned 'dbghelp.dll' by the Sysinternals tool VMMap. Adversaries may place a malicious, unsigned 'dbghelp.dll' in a location where VMMap (vmmap.exe or vmmap64.exe) will load it instead of the legitimate, signed version. This technique can be used for defense evasion, persistence, or privilege escalation by executing arbitrary code within the context of a trusted application.
This rule detects potential DLL sideloading activity involving the 'JSESPR.dll' library when it is loaded from a location other than the legitimate 'C:\Program Files\Common Files\Justsystem\JsSchHlp\' directory. This specific behavior is associated with the JUSTSYSTEMS Japanese word processor and has been observed in campaigns like 'Operation LiberalFace' targeting Japanese political entities.
Detects DLL sideloading of system DLLs that are not present on the system by default (at least not in system directories).
Usually this technique is used to achieve UAC bypass or privilege escalation.
Usually this technique is used to achieve UAC bypass or privilege escalation.
Detects processes loading the non-existent DLL "ShellChromeAPI.dll". This behavior is often associated with DLL sideloading attacks, where an adversary places a malicious DLL with a name that a legitimate application expects to load. A known example involves "DeviceEnroller.exe" attempting to load this DLL when used with the "PhoneDeepLink" flag. Adversaries can exploit this by dropping their own renamed malicious DLL to achieve defense evasion, persistence, or privilege escalation.
Detects DLL sideloading of 'vmGuestLib.dll' by the 'WmiApSrv.exe' service. This rule specifically looks for instances where 'WmiApSrv.exe' loads 'vmGuestLib.dll' from a path that includes '\VMware\VMware Tools\vmStatsProvider\win32', while the DLL itself is not legitimately signed. This behavior can indicate an attempt to execute malicious code by tricking a legitimate process into loading a rogue DLL.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap utility. This rule specifically looks for VMMap (vmmap.exe or vmmap64.exe) loading a dbghelp.dll from a non-standard path ('C:\Debuggers\dbghelp.dll') where the loaded DLL is signed. This could indicate an adversary attempting to load a malicious, yet signed, DLL to evade detection or achieve persistence/privilege escalation.
This analytic detects when a Microsoft Office application loads the `taskschd.dll` library. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing by creating scheduled tasks. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment.
The analytic detects the abuse of SqlWriter and SQLDumper executables to sideload the vcruntime140.dll library. It leverages Sysmon EventCode 7 logs, focusing on instances where SQLDumper.exe or SQLWriter.exe load vcruntime140.dll, excluding legitimate loads from the System32 directory. This activity is significant as it indicates potential DLL sideloading, a technique used by adversaries to execute malicious code within trusted processes. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and evade detection by blending with legitimate processes.
The analytic detects the suspicious loading of DLLs by spoolsv.exe, potentially indicating PrintNightmare exploitation. It leverages Sysmon EventCode 7 to identify instances where spoolsv.exe loads multiple DLLs from the Windows System32 spool drivers x64 directory. This activity is significant as it may signify an attacker exploiting the PrintNightmare vulnerability to execute arbitrary code. If confirmed malicious, this could lead to unauthorized code execution, privilege escalation, and persistent access within the environment, posing a severe security risk.
The following analytic detects a potential UAC bypass using the colorui.dll COM Object. It leverages Sysmon EventCode 7 to identify instances where colorui.dll is loaded by a process other than colorcpl.exe, excluding common system directories. This activity is significant because UAC bypass techniques are often used by malware, such as LockBit ransomware, to gain elevated privileges without user consent. If confirmed malicious, this could allow an attacker to execute code with higher privileges, leading to further system compromise and persistence within the environment.
The following analytic identifies the loading of four specific Windows DLLs (credui.dll, dbghelp.dll, samcli.dll, winhttp.dll) by a non-standard process. This detection leverages Sysmon EventCode 7 to monitor DLL load events and flags when all four DLLs are loaded within a short time frame. This activity is significant as it may indicate the presence of Brute Ratel C4, a sophisticated remote access tool used for credential dumping and other malicious activities. If confirmed malicious, this behavior could lead to unauthorized access, credential theft, and further compromise of the affected system.
The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Official Sysmon TA versions.
The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a DLL hijacking attempt, a technique used by attackers to gain unauthorized access and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system.
The analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.
Page 52 of 55