Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
7
6
4
3
2
Contributors
7
4
3
2
2
Categories
5
4
4
4
4
Platforms
22
2
2
Products / Services
6
4
4
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects instances where a digitally signed executable loads a DLL from a non-standard, user-writable directory (such as Downloads, Desktop, Temp, or AppData). This behavior is characteristic of DLL side-loading, an evasion technique used to execute malicious code by placing a rogue DLL in a location where a legitimate binary might search for its dependencies, often used by threat actors to persist or maintain covert execution.
Detects the loading of unsigned DLLs from non-system directories where the DLL filename matches common Windows system libraries. This behavior is indicative of DLL side-loading, where adversaries use a trusted, digitally-signed application to load a malicious DLL in an attempt to bypass security controls and maintain persistence.
Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.
Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
This rule detects BITS job configuration files that exhibit characteristics of persistence mechanisms. It looks for the presence of BITS job structure elements, and sevral indicators suggesting abuse
Detects BITS job configuration files with known persistence mechanisms, such as running at startup
This rule detects BITS job configuration files that exhibit characteristics of persistence mechanisms. It looks for the presence of BITS job structure elements, and sevral indicators suggesting abuse
This rule detects a highly suspicious activity where the Notepad++ updater process (GUP.exe) spawns the Windows Command Shell (cmd.exe) to execute various reconnaissance commands. This behavior is specifically linked to the Chrysalis backdoor, which was involved in a supply chain attack targeting Notepad++. The presence of commands like 'whoami', 'tasklist', 'systeminfo', 'ipconfig', and 'net' (with user, view, or group arguments) indicates an adversary attempting to gather information about the compromised system and network.
Detects a DLL sideloading technique used by APT41 where the legitimate VipreAV executable 'vetysafe.exe' is used to load a malicious 'sbamres.dll'. This is a known method for deploying the Deed RAT.
Detects the creation of a Windows service with a suspicious name or an executable path in an unusual location, a technique used by APT41 for persistence.
Detects the DLL sideloading of sbamres.dll by the legitimate VipreAV component vetysafe.exe. This technique has been associated with China-linked threat actors like Space Pirates, Kelp (Salt Typhoon), and APT41 subgroups.
The following analytic detects the use of the decompile parameter with the HTML Help application (HH.exe). This behavior is identified through Endpoint Detection and Response (EDR) telemetry, focusing on command-line executions involving the decompile parameter. This activity is significant because it is an uncommon command and has been associated with APT41 campaigns, where it was used to unpack HTML help files for further malicious actions. If confirmed malicious, this technique could allow attackers to execute arbitrary commands, potentially leading to further compromise and persistence within the environment.
Detects potential DLL side-loading of jli.dll. JLI.dll has been observed being side-loaded by Java processes by various threat actors, including APT41, XWorm, and others in order to load malicious payloads in context of legitimate Java processes. The rule filters out legitimate loads from common installation paths and specific applications like Eclipse.
Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code
Detects a suspicious Microsoft certutil execution with sub commands like 'decode' sub command, which is sometimes used to decode malicious code
Detects a DNS query to 'azurewebsites.net' originating from a process that is not a recognized web browser. Threat actors have frequently used 'azurewebsites.net' for malware hosting and data exfiltration. This rule aims to identify suspicious communication patterns where non-browser applications might be attempting to communicate with known malicious infrastructure hosted on Azure.
Page 1 of 2