Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,155 detections
Filters
Last updated
All Time
Detection languages
511
470
72
54
20
Contributors
259
229
161
151
125
Categories
20,443
11,831
5,872
5,155
4,866
1,155
Platforms
1,134
23
13
1
Products / Services
427
403
35
18
15
MITRE Techniques
810
468
459
437
429
CVEs
6
6
5
5
3
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Detects blocked image load events with revoked certificates by code integrity.
Detects image load events with revoked certificates by code integrity.
Detects processes loading modules related to PCRE.NET package
Detects any GAC DLL being loaded by an Office Product
Detects a remote DLL load event via "rundll32.exe".
Detects loaded unsigned image on the system
Detects the load of dbghelp/dbgcore DLL (used to make memory dumps) by suspicious processes.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Tools like ProcessHacker and some attacker tradecract use MiniDumpWriteDump API found in dbghelp.dll or dbgcore.dll.
As an example, SilentTrynity C2 Framework has a module that leverages this API to dump the contents of Lsass.exe and transfer it over the network back to the attacker's machine.
Detects SILENTTRINITY stager dll loading activity
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class
Loading unsigned image (DLL, EXE) into LSASS process
Detects any assembly DLL being loaded by an Office Product
Detects CLR DLL being loaded by an Office Product
Detects Microsoft Excel loading an Add-In (.xll) file from an uncommon location
Detects outlvba (Microsoft VBA for Outlook Addin) DLL being loaded by the outlook process
Detects VB DLL's loaded by an office application. Which could indicate the presence of VBA Macros.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicates WMI ActiveScriptEventConsumers EventConsumers activity.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario.
Page 55 of 55