Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects DeElevate64.exe within the Stardock Smart DeElevation Tool directory loading I++u.dll, a known malicious loader dependency associated with patched DeElevator64.dll usage.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Detects when a Bandizip executable loads an unsigned dynamic-link library (DLL) from outside the standard installation directory, where the Bandizip process was launched by explorer.exe, potentially indicating DLL side-loading.
Detects the WinLol Rust dropper staging a DLL sideload by writing a copy of Microsoft OneDrive.exe and a proxy version.dll into a user temp directory by a non-OneDrive, non-installer process.
Detects ADNotificationManager.exe (Adobe Notification Manager) running from an unusual or unknown directory, which may be indicative of DLL Side-Loading. This binary has been observed being abused by multiple threat actors including GOLD BLADE to sideload malicious DLLs and deliver C2 payloads such as Havoc.
Detects DLL files written to common Windows user directories, including Desktop, Downloads, Pictures, Videos, Documents, Music, and other user profile folders. These files may be written by archive extraction utilities such as Windows Explorer, 7-Zip, or WinRAR, web browsers during downloads, or other applications.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
Detects a renamed PSF-signed pythonw.exe (with an original file name of pythonw.exe but a different on-disk name) launched from a user-writable path under Users. The command line consists only of its own path, which is consistent with ._pth based path configuration abuse for loading attacker code stealthily.
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
The following analytic identifies potential DLL search order hijacking or DLL sideloading by detecting known Windows libraries loaded from non-standard directories. It leverages Sysmon EventCode 7 to monitor DLL loads and cross-references them with a lookup of known hijackable libraries. This activity is significant as it may indicate an attempt to execute malicious code by exploiting DLL search order vulnerabilities. If confirmed malicious, this could allow attackers to gain code execution, escalate privileges, or maintain persistence within the environment.
This rule detects potential DLL sideloading by monitoring known legitimate Windows binaries that are commonly abused to load malicious DLLs from non-standard directories (i.e., not System32, SysWOW64, or WinSxS). This activity is often associated with the TerminalFix / Lorem Ipsum Loader campaign.
This rule detects potential DLL sideloading activity associated with the Lorem Ipsum Loader. It monitors image load events to identify specific legitimate Windows binaries (often used for sideloading) that load non-system DLLs. The rule filters out legitimate DLL loads from standard Windows system directories to highlight anomalous behavior.
Detects anomalous execution of PowerShell commands spawned by processes identified as 'javaw.exe' or 'GlobalTellurSync.exe' (associated with DragonForce backdoor activity). The detection focuses on instances where these processes launch from non-standard user-writable directories (e.g., AppData, Temp) and execute PowerShell commands that contain obfuscated arguments or payloads, while excluding standard scheduled task invocations.
Detects a specific persistence chain attributed to DragonForce where the 'javaw.exe' process side-loads a malicious 'jli.dll' from a non-standard, user-writable directory. The rule correlates this DLL image load with the subsequent reading of an encrypted, host-bound payload file ('rvsdiqw.txt') by the same process, which is then decrypted and injected into memory.
Detects the creation or modification of Windows service registry keys where the ImagePath points to a binary with a non-standard file extension (e.g., .s, .c, .l). This behavior is associated with the NeedyMantis malware family, which utilizes non-standard naming for persistence mechanisms to evade basic detection.
The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security.
This rule detects instances of 'javaw.exe' executing from unusual directories (e.g., AppData, Temp, Users\Public) while loading a 'jli.dll' file from a related non-standard path, or simultaneously being associated with a scheduled task execution involving 'GlobalTellurSync'. This behavior is indicative of potential DLL side-loading or a persistence mechanism where a legitimate Java executable is repurposed to run malicious code.
This rule detects instances of 'javaw.exe' executing from unusual directories (e.g., AppData, Temp, Users\Public) while loading a 'jli.dll' file from a related non-standard path, or simultaneously being associated with a scheduled task execution involving 'GlobalTellurSync'. This behavior is indicative of potential DLL side-loading or a persistence mechanism where a legitimate Java executable is repurposed to run malicious code.
Detects DLLs potentially associated with the 'Lorem Ipsum Loader' malware family. These DLLs are designed to sideload into legitimate applications and contain embedded shellcode that is encoded as a sequence of English words to bypass entropy-based detection. The rule looks for the presence of the word-encoded blob alongside specific filenames commonly used in this sideloading technique.
Detects the loading of an unsigned or invalidly signed DLL from commonly abused user-writable directories (Temp, AppData, Public). This behavior is characteristic of DLL side-loading techniques, often used by threat actors like the Lazarus Group to execute malicious code via a legitimate, trusted application.
Detects a file named dnsapi.dll created/modified outside System32/SysWOW64/WinSxS (the only legitimate locations for the real system DLL). Now requires the file to BOTH land in one of the known NeedyMantis sideload staging folders AND match the published 3448-byte spoofed-config size -- previously the size check alone could match unrelated dnsapi.dll copies anywhere on disk; requiring both signals together removes that bypass.
Detects a suspicious sequence of events characteristic of NeedyMantis's hands-on-keyboard activity. The rule identifies file staging (creation or modification of suspicious DLLs from network shares) followed by remote command execution (via Impacket-like service interaction) and subsequent execution of binaries vulnerable to DLL sideloading.
Page 1 of 48