Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
81 detections
Filters
Last updated
All Time
Detection languages
31
13
7
7
6
Contributors
20
15
11
7
5
Categories
37
21
13
12
11
Platforms
69
7
3
2
1
Products / Services
27
20
6
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
2
1
IDS Protocols
2
1
Detects direct execution and testing of SAP Function Modules via SE37 test frame. This identifies correlation between a transaction start (AU7) and a function module call (BU4) in close succession
This rule detects the loading of a specific module named 'tdwp.dll' by the 'rnpkeys.exe' process, where both files are located within a 'keyroll' directory. This pattern is indicative of potential DLL sideloading or execution of unauthorized components where a legitimate-looking process loads a custom, possibly malicious, library from a non-standard location.
Detects the SectopRAT shellcode execution stage by identifying the concurrent access of a specific encrypted database file (Activation.Desktop.db) and the loading of a malicious DLL (stp_aim_x64_vc15.dll) on the same device within a 5-minute window. This behavior suggests the decryption and execution of shellcode via DLL callback abuse.
Detects anomalous child process execution from SharePoint's w3wp.exe worker process following the loading of suspicious .NET assemblies (PresentationFramework.dll, System.Xaml.dll, System.Data.Services.dll). This behavior is indicative of a post-exploitation stage for SharePoint SafeControls bypass vulnerabilities, where a gadget chain is utilized to execute unmanaged or child processes.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
This rule detects potential SectopRAT loader activity by identifying non-.NET-native processes accessing 'pool.db' in the ProgramData directory followed by the immediate loading of .NET CLR libraries (clr.dll or mscoreei.dll). This pattern is indicative of reflective loading of a decrypted .NET payload into memory within a target process.
Detects instances where processes other than legitimate PowerShell binaries load the .NET Common Language Runtime (clr.dll) or the System.Management.Automation assembly. This behavior is often indicative of 'PowerShell-less' execution techniques, where adversaries interact with the PowerShell engine directly from arbitrary host processes to execute malicious code or scripts.
Detects the loading of the System.Management.Automation.dll (PowerShell assembly) by processes other than standard PowerShell executable files. This behavior often indicates an attempt to execute PowerShell code from a non-standard process, potentially to bypass security controls or obfuscate malicious activity.
Detects the initialization of COFF object files within a process memory context, characteristic of the MovieReaper stage-2 implant. This rule identifies the invocation of a 'module_init' exported function, which serves as a common mechanism for executing Beacon Object Files (BOF) or similar in-memory command loading interfaces.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Detects the creation and immediate deletion of a .dylib file within the 'Library/Application Support/updated/instances/' directory on macOS. This pattern is often associated with the ProRAM technique where a shared library is written to disk, loaded via dlopen, and quickly removed to evade static file-based detection.
Detects the use of PowerShell's System.Reflection.Assembly Load methods to dynamically load .NET assemblies into process memory from a byte array. This technique is often used by adversaries to execute malicious code directly in memory, bypassing disk-based detection mechanisms.
Detects the execution or loading of modules, processes, or command lines associated with the Stella_Gary C# backdoor framework. This framework is utilized by the Kimsuky (APT-C-55) threat group as part of a modular, plugin-based capability loading architecture.
This rule detects potential BabylonRAT malware samples by identifying a combination of dynamic API resolution techniques (using GetProcAddress and LoadLibrary) and XOR-obfuscated string blocks representing critical DLL and API names. The detection utilizes high file entropy and specific artifact strings to identify binaries attempting to evade static analysis.
Detects Windows PE files exhibiting characteristics of BabylonRAT, specifically the use of dynamic API resolution via GetProcAddress and LoadLibrary to hide imports, combined with XOR-obfuscated strings for sensitive functions like CreateProcess, WriteFile, and InternetOpen to evade static analysis.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Page 1 of 4