Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicate WMI ActiveScriptEventConsumers activity. This is a common technique for persistence and privilege escalation.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
Detects Microsoft Excel loading an Add-In (.xll) file. Adversaries may use malicious Excel Add-Ins to execute arbitrary code, establish persistence, or perform other malicious activities. This rule specifically looks for the loading of '.xll' files by 'excel.exe'.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
Detects the loading of a DLL associated with the SILENTTRINITY stager, specifically looking for the string 'st2stager' in the DLL's description.
This rule detects when an unsigned image (DLL or EXE) is loaded into the Local Security Authority Subsystem Service (LSASS) process. Adversaries often inject malicious, unsigned code into LSASS to dump credentials, as LSASS stores sensitive authentication material. Detecting unsigned code in this critical process can indicate an attempt at credential dumping or other forms of privilege escalation.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
This rule detects when Microsoft Excel loads an Add-In (.xll) file from an uncommon or potentially suspicious location. Adversaries often use XLL files for initial access or execution by embedding malicious code within them, and loading them from non-standard directories like Desktop, Downloads, Temp, or Public user folders can indicate malicious activity. The rule specifically looks for excel.exe loading an .xll file from a predefined list of suspicious directories.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). This rule specifically looks for `wmic.exe` loading scripting libraries like `jscript.dll` or `vbscript.dll`.
Detects the loading of unsigned dbghelp.dll or dbgcore.dll, which are DLLs used for creating memory dumps. This activity is suspicious as these DLLs are often leveraged by attackers, for example, to dump credentials from processes like LSASS using the MiniDumpWriteDump API. Tools like ProcessHacker and the SilentTrinity C2 Framework are known to use this technique.
Detects processes loading modules related to the PCRE.NET package, specifically looking for a unique temporary path often associated with its deployment. This could indicate the execution of code leveraging this package, potentially for malicious purposes like regular expression-based obfuscation or payload delivery.
This rule detects the loading of 'sdiageng.dll' by 'msdt.exe'. This specific combination is known to be exploited by vulnerabilities such as CVE-2022-30190 (Follina) and DogWalk, which leverage msdt.exe for arbitrary code execution by loading a diagnostic library.
Detects the loading of DLLs associated with the Time Travel Debugging (TTD) utility. Adversaries can leverage TTD, specifically `tttracer.exe`, to execute malicious processes or dump sensitive process memory, such as that of `lsass.exe`, for credential access. This rule focuses on the dynamic loading of TTD-related DLLs, indicating potential use of the utility.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects `rundll32.exe` loading a renamed `comsvcs.dll` to dump process memory, which is a common technique for credential dumping, specifically targeting LSASS. The rule looks for `rundll32.exe` executions where the loaded image is NOT the legitimate `comsvcs.dll` (implying a renamed or malicious version).
Detects when the 'outlvba.dll' (Microsoft VBA for Outlook Addin) is loaded by the 'outlook.exe' process. This activity can indicate the use of VBA macros within Outlook, which can be leveraged for persistence or execution by adversaries.
Page 54 of 55