Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the DLL sideloading technique used by the Evasive Panda APT group, where the legitimate and signed 'evteng.exe' executable is used to load the malicious 'libpython2.4.dll'.
Detects a specific DLL side-loading pattern used by APT37 in the 'Operation Artemis' campaign. A legitimate Sysinternals utility (e.g., 'mhelp.exe', 'vhelp.exe', 'Volumeid1.exe') is executed from a suspicious directory and loads a malicious 'version.dll' from the same path.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
Detects DLL side-loading attacks where consent.exe loads known malicious DLLs (version.dll, rtworkq.dll, wmsgapi.dll, and the older msimg32.dll) from non-standard locations. This technique is used by Shanya-packed malware including EDR Killer and CastleRAT to load malicious payloads while appearing as a legitimate Windows UAC process.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects the creation of malicious DLL files used for side-loading by the Ashen Lepus group's AshTag malware suite. These DLLs are often dropped in non-standard locations to be loaded by legitimate executables.
Detects DLL side-loading techniques used by Project AK47 loaders. This involves legitimate executables like 7z.exe or clink_x86.exe loading malicious DLLs with similar names from the same directory.
Detects the RomCom loader 'msedge.dll' being loaded from a location outside of the legitimate Microsoft Edge installation directory. This is a known TTP for the RomCom threat group to load their Mythic Agent, often as a result of COM hijacking.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
NotDoor is a Outlook Macros to monitor incoming emails for specific triggers, and when the system receives such an email, it executes code paths found in the VBA macro. This allows an attacker to exfiltrate data, upload files, and execute commands on the victim’s computer while using an inconspicuous application as the C2.
Detects potential DLL Search Order Hijacking activity where a DLL is created in a legitimate software directory, followed by a process execution from that same directory. This pattern is consistent with UNC1549's technique of dropping malicious DLLs to be loaded by trusted applications.
Detects a process loading a commonly hijacked system DLL from a non-standard file path that is unsigned. This is indicative of DLL Search Order Hijacking, a technique used by malware like Rhadamanthys to achieve persistence and stealthy execution.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
Detects the DLL sideloading of sbamres.dll by the legitimate VipreAV component vetysafe.exe. This technique has been associated with China-linked threat actors like Space Pirates, Kelp (Salt Typhoon), and APT41 subgroups.
Detects DLL side-loading patterns associated with the Lazarus Group's Operation DreamJob campaign. This involves legitimate Windows executables loading malicious DLLs from non-standard paths.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
Detects the loading of version.dll from a non-standard directory, a technique associated with DLL Sideloading. This specific variant was observed being used by a loader for TorNet and PureHVNC.
This rule detects modifications to the HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CLSID}\InProcServer32 registry key where the RegistryValueData ends with ".dll" and does not point to common system directories (%systemroot%, C:\Program Files (x86)\, C:\Program Files\). This behavior is indicative of CLSID hijacking, a technique used by adversaries to achieve persistence or privilege escalation by redirecting legitimate COM object calls to a malicious DLL.
Detects potential DLL sideloading associated with the Lazarus Group's DreamLoader campaign. This involves legitimate Windows executables (wkspbroker.exe, wksprt.exe) being executed from non-standard directories shortly after a DLL is created in the same location.
This rule detects suspicious execution of 'RUNDLL32.EXE' with specific command-line arguments. It looks for instances where 'RUNDLL32.EXE' is executed with both a backslash and a comma in the command line, combined with specific DLL names or keywords like 'iamnotarobot.dll', 'checkme.dll', 'machinerie.dll', 'humanCheck', or 'verifyme'. This pattern is often indicative of malicious DLL loading or persistence mechanisms.
Page 34 of 48