Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,872
5,155
4,866
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
This rule detects a Python process loading a DLL named 'python20.dll'. This specific combination was observed in the CL-UNK-1068 activity, where attackers used this technique for purposes such as launching scanning tools, maintaining covert tunnels, or executing other malicious programs while attempting to blend in with legitimate software. The rule focuses on this specific pattern to identify strong leads related to the campaign, rather than generating broad alerts for all Python activities or DLL loads.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
This rule detects instances where a Python process loads the 'python20.dll' file. This activity is suspicious because 'python20.dll' is an older Python 2 library, and its loading by a Python process in modern environments may indicate a sideloading technique. This could be indicative of an attacker using Python as a cover to load malicious helper files for reconnaissance, tunneling, or other post-exploitation activities.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
Detects potential VELETRIX loader activity by identifying processes loading 'drstat.dll' from a path, where the loader executable is not 'drstat.exe'.
Detects attempted file load events that did not meet the signing level requirements. It often means the file's signature is revoked or a signature with the Lifetime Signing EKU has expired.
This event is best correlated with EID 3089 to determine the error of the validation.
This event is best correlated with EID 3089 to determine the error of the validation.
Detects the loading of 'log.dll' by 'BluetoothService.exe' or 'GUP.exe' from non-standard directories, a technique associated with the Chrysalis backdoor used in the Notepad++ supply chain attack.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
Detects DLL side-loading activity associated with the Silver Fox APT, where the legitimate Thunder.exe application is executed from a temporary directory to load a malicious, unsigned libexpat.dll.
Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.
Detects the presence and execution of Defendnot components. This tool is used to disable Microsoft Defender by exploiting the Windows Security Center trust model, which involves injecting a malicious DLL into the trusted Task Manager process.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects the DLL sideloading of the Kazuar v3 loader (hpbprndiLOC.dll) by a legitimate Hewlett-Packard printer driver installer (hpbprndi.exe). This technique is used by Turla to initiate its infection chain.
Detects COLDDRIVER malware loading specific malicious DLLs (machinerie.dll, checkme.dll, iamnotarobot.dll) via rundll32.exe, or the loading of specific malicious DLLs identified by their SHA256 hashes.
This rule detects the loading of unsigned or untrusted DLLs from suspicious, non-standard file paths into a set of common Windows processes. It correlates DLL load events with recent process executions to identify potentially malicious shared module usage, often indicative of DLL hijacking or side-loading techniques. The rule specifically looks for DLLs loaded from paths like \Users\Public\, \Temp\, \AppData\, \ProgramData\, \Downloads\, and \PerfLogs\, into processes such as explorer.exe, svchost.exe, lsass.exe, and common applications like chrome.exe or winword.exe. It then filters these events to only include DLLs that are either unsigned or untrusted, and whose signer is not part of a predefined list of trusted entities (e.g., Microsoft, Google).
This rule detects suspicious DLL loads by the 'consent.exe' process. It specifically looks for known DLLs often abused in DLL side-loading or hijacking scenarios, such as 'msimg32.dll', 'version.dll', 'rtworkq.dll', 'wmsgapi.dll', and other DLLs containing 'sh4nya' or 'shanya' in their name. The rule excludes legitimate Microsoft versions of 'wmsgapi.dll' and 'msimg32.dll' based on their SHA1 hashes to reduce false positives. The 'consent.exe' process is associated with User Account Control (UAC) and its abuse can lead to privilege escalation or defense evasion.
This rule detects the execution of 'rundll32.exe' with suspicious DLL names in the command line, specifically 'machinerie.dll', 'checkme.dll', or 'iamnotarobot.dll'. Additionally, it identifies the loading of specific malicious DLLs by their SHA256 hashes, which have been associated with ColdRiver (Star Blizzard) activity. This behavior is indicative of potential malware execution or persistence mechanisms.
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
Page 29 of 33