Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
3
Contributors
2
1
Categories
3
2
2
1
1
Platforms
3
Products / Services
2
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query
Look for the creation of suspicious DLL files spawned in the \spool\ folder along with DLLs that were recently loaded afterwards from \Old.
