Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
196 detections
Filters
Last updated
All Time
Detection languages
78
49
15
12
10
Contributors
65
32
16
16
15
Categories
79
67
48
38
37
Platforms
189
7
2
2
Products / Services
63
55
23
15
10
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
5
IDS Classtypes
1
1
IDS Protocols
1
1
Detects possible abuse of Notepad++ installer (v8.8.1) where a malicious regsvr32.exe is executed from an untrusted directory, leading to privilege escalation to SYSTEM.
KQL Query from file: Detecting Windows Side-Loading DLL attacks
Detects process injection using the signed Windows tool Mavinject32.exe
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Detects the access to processes by other suspicious processes which have reflectively loaded libraries in their memory space.
An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way),
it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory.
Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that
most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries.
The latter should also be considered suspicious.
An example is SilentTrinity C2 behaviour. Generally speaking, when Sysmon EventID 10 cannot reference a stack call to a dll loaded from disk (the standard way),
it will display "UNKNOWN" as the module name. Usually this means the stack call points to a module that was reflectively loaded in memory.
Adding to this, it is not common to see such few calls in the stack (ntdll.dll --> kernelbase.dll --> unknown) which essentially means that
most of the functions required by the process to execute certain routines are already present in memory, not requiring any calls to external libraries.
The latter should also be considered suspicious.
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
TAIDOOR RAT DLL Load
Sigma
Detects specific process characteristics of Chinese TAIDOOR RAT malware load
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Detects a potential remote threat creation with certain characteristics which are typical for Cobalt Strike beacons
In this query, we hunt for inbound emails having URLs from QR codes and suspicious keywords in subject
Detects potential DLL injection and execution using "Tracker.exe"
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
This binary can be abused for DLL injection, arbitrary command and process execution.
Detects a renamed "dctask64.exe" execution, a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
This binary can be abused for DLL injection, arbitrary command and process execution.
Detects process injection using the signed Windows tool Mavinject32.exe
TAIDOOR RAT DLL Load
Sigma
Detects specific process characteristics of Chinese TAIDOOR RAT malware load
Detects potential DLL injection and execution using "Tracker.exe"
Detects the execution of "dctask64.exe", a signed binary by ZOHO Corporation part of ManageEngine Endpoint Central.
This binary can be abused for DLL injection, arbitrary command and process execution.
This binary can be abused for DLL injection, arbitrary command and process execution.
Detects potential use of CreateRemoteThread api and LoadLibrary function to inject DLL into a process
In this query, we summarize volume of inbound emails with QR code URLs in last 30 days
This analytic identifies suspicious remote thread execution where the `wermgr.exe` process injects code into known browser processes such as `firefox.exe`, `chrome.exe`, `iexplore.exe`, and `microsoftedgecp.exe`. It uses Sysmon EventCode 8 logs to detect this behavior by monitoring the `SourceImage` and `TargetImage` fields. This activity is significant because it is indicative of Qakbot malware, which is known to inject malicious code into legitimate processes to steal information. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data from the compromised host.
This analytic detects the loading of the `dynwrapx.dll` module, which is associated with the DynamicWrapperX ActiveX component. This detection leverages Sysmon EventCode 7 to identify processes that load or register `dynwrapx.dll`. This activity is significant because DynamicWrapperX can be used to call Windows API functions in scripts, making it a potential tool for malicious actions. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence on the host. Immediate investigation of parallel processes and registry modifications is recommended.
Page 9 of 10