Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,872
5,155
4,866
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects Python loading a .pyd or .so extension from common user-controlled or temporary directories (AppData, Temp, Downloads, Projects, /tmp/, /home/.../Downloads/) rather than a trusted package installation. This behavior is indicative of the InvisibleFerret malware, which uses Cython extensions for its operations.
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
Detects the in-memory execution of .NET assemblies from the Go implant using the extracted execute-assembly_windows.go structures. Specifically looks for 'mscoree.dll' being loaded by a process named 'setup.exe'.
Detects attempts to sideload a malicious DLL named 'NotepadPlusPlus.dll' from a user's AppData folder. This technique is often used by adversaries to achieve persistence, escalate privileges, or evade defenses by masquerading malicious code as a legitimate library.
Detects the sideloading of 'msvcp140.dll' or 'mscoree.dll' when loaded from a 'ProgramData' directory that does not contain 'Microsoft' in its path. This pattern is indicative of an adversary attempting to execute malicious code by placing a malicious DLL in a location where a legitimate application will load it, bypassing standard security controls.
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects evidence of Donut shellcode execution by monitoring 'mscoree.dll' image loads initiated by Python processes. Donut is an open-source tool used to generate position-independent shellcode, often for injecting malicious payloads into memory. This rule specifically looks for scenarios where Python is used as the initiating process for loading the .NET runtime library 'mscoree.dll', which can be indicative of Donut shellcode execution.
Detects a recently downloaded utility executable loading autorun.dll from the same writable directory, consistent with DLL side-loading. This behavior is often associated with malware attempting to establish persistence or elevate privileges by abusing legitimate applications.
Detects the loading of 'tpsvcloc.dll' from the 'Windows Fonts' directory by a ThinPrint-related signed host. This behavior is indicative of potential DLL side-loading or hijacking, as 'tpsvcloc.dll' is typically associated with ThinPrint software and should not be loaded from the Fonts directory. The rule focuses on identifying this specific anomalous module load event.
This rule detects the loading of 'tpsvcloc.dll' from the 'Windows\Fonts' directory by a process associated with ThinPrint. This behavior is indicative of DLL sideloading, where a malicious DLL is placed in a location that a legitimate application (ThinPrint in this case) will load, allowing for arbitrary code execution. The rule specifically looks for image load events where the module name is 'tpsvcloc.dll', the module path is within 'Windows\Fonts', and the actor process image path contains 'thinprint', 'tpsvc', or 'tp*.exe'.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Identifies 'setup.exe' originating from a 'Hiring Portal' directory loading the 'UpdateChecker.dll'. This behavior is indicative of DLL sideloading, a technique used by the 'Screening Serpens' APT group.
Identifies authentication binaries (sshd, su, sudo) loading a pam_unix.so module that contains anomalous compile-time RPATHs pointing to the attacker's staging directories, as observed in the Velvet Ant campaign.
This rule detects modifications to the 'AppInit_DLLs' or 'LoadAppInit_DLLs' registry keys, which can be used by adversaries to establish persistence. When these registry keys are modified, a DLL specified in their values will be loaded into nearly every process that loads user32.dll, providing a mechanism for arbitrary code execution.
Udm Aspose Email Load
YARA-L
Targets Aspose.Email DLL loading by a user-writable or masquerading executable rather than an approved mail application. The UDM rule retains principal and target context for correlation.
Identifies the execution of the Connection.dll RAT spawning the decoy Meeting Room process, specifically looking for the loading of 'Connection.dll' and the simultaneous execution of 'SystemtUpdateTaskMachine.exe' by the same initiating process.
Detects execution chains where a suspicious DLL (autorun.dll) is loaded from user-controlled directories and followed by a silent MSI installation. This pattern is commonly associated with malware staging and secondary payload deployment.
Detects attempts to load critical system DLLs (ntdll.dll, kernel32.dll, user32.dll, advapi32.dll) from non-standard or suspicious file paths. This behavior can indicate an attempt to inject malicious code or evade detection by using modified or malicious versions of legitimate system modules.
Detects attempts to load critical system DLLs (ntdll.dll, kernel32.dll, user32.dll, advapi32.dll) from non-standard or suspicious file paths. This behavior can indicate an attempt to inject malicious code or evade detection by using modified or malicious versions of legitimate system modules.
Detects loading of shared DLL modules from suspicious network paths
Page 27 of 33