Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,872
5,155
4,866
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects the OXLOADER malware dropping a renamed copy of dui70.dll with a malicious RWX .xtext section into the user's Temp folder, followed by the loader process reading mpr.dll, which is a known behavior related to its sandbox check and API resolution execution chain.
Detects potential sandbox evasion behavior characteristic of OXLOADER malware. The rule identifies a non-system process dynamically loading 'mpr.dll' and terminating shortly thereafter (within 1 minute). This sequence is associated with anti-sandbox techniques where malware attempts to trigger an error (e.g., ERROR_BAD_NAME 0x43) via a malformed UNC path using 'WNetAddConnection2W' to detect if it is running within an analysis environment.
Detects python.exe loading non-standard Cython modules.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
This rule detects potential persistence attempts by monitoring for the execution of 'schtasks.exe' with the '/create' flag or the loading of 'taskschd.dll' by suspicious parent processes. These parents include script interpreters (e.g., powershell, wscript), Microsoft Office applications, and various living-off-the-land binaries or web-related utilities, which are commonly abused by adversaries to establish persistence via the Windows Task Scheduler.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Detects the sideloading of the tampered DLL 'AggregatorHost.dll' by a process named '._cache_GAME1.exe', which is associated with hijacking live Steam sessions.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Detects vcpktsvr.exe loading a local libcef.dll associated with the non-standard cef_api_mash export used by ZiChatBot.
Detects the initialization of the NetQosCim provider via WMI, which threat actors can use to silently throttle EDR telemetry without terminating the agent.
Detects the legitimate Microsoft binary Fondue.exe loading APPWIZ.cpl from a non-standard public directory (C:\Users\Public\), indicating DLL side-loading, a technique observed in campaigns like Dropping Elephant.
This rule broadly hunts for instances where legitimate Microsoft update binaries (like mobsync.exe, w3wp.exe, certutil.exe, or svchost.exe) load unknown DLLs from non-standard directories, indicating potential DLL sideloading.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects a persistent module loading a previously unseen DLL from its task or plug-in directory after local IPC activity. This behavior is associated with the Kazuar malware.
Detects the loading of the QoS WMI provider DLL (qoswmi.dll) into the WMI provider host (wmiprvse.exe). This behavior is associated with the EDRChoker technique, which can be used for stealthy execution and EDR evasion.
Identifies XWorm dynamically identifying and invoking the Run method of a reflected plugin assembly using .NET late binding. This detection specifically looks for 'LdrLoadDllApiCall' events where 'mscoree.dll' is loaded by a process whose filename matches 'Win.Kernel_Svc'.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects the loading of 'tpsvcloc.dll' from the 'Windows Fonts' directory by a ThinPrint-related signed host. This behavior is indicative of potential DLL side-loading or hijacking, as 'tpsvcloc.dll' is typically associated with ThinPrint software and should not be loaded from the Fonts directory. The rule focuses on identifying this specific anomalous module load event.
Udm Aspose Email Load
YARA-L
Targets Aspose.Email DLL loading by a user-writable or masquerading executable rather than an approved mail application. The UDM rule retains principal and target context for correlation.
Page 26 of 33