Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects attempts to abuse Azure Browser Single Sign-On (SSO) by monitoring for the loading of the 'MicrosoftAccountTokenProvider.dll' library. This DLL is involved in requesting OAuth 2.0 refresh tokens for Azure AD-authenticated Windows users on Azure AD-joined machines, enabling SSO in browsers. An attacker could leverage this to authenticate to Azure AD as the compromised user within a browser. The rule filters out legitimate loads by common processes like BackgroundTaskHost.exe, Visual Studio (devenv.exe), Internet Explorer (iexplore.exe), Microsoft Edge (msedge.exe, msedgewebview2.exe), and OneDrive (OneDrive.exe) to reduce false positives.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
This rule detects the execution of 'GUP.exe' (Notepad++ updater) from any directory other than its legitimate installation paths within 'Program Files' or user-specific 'AppData' folders. This behavior is often indicative of DLL side-loading attacks where a malicious GUP.exe might be placed in a controlled directory to load a malicious DLL.
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process. This rule specifically looks for the arubanetsvc.exe process loading specific DLLs (wtsapi32.dll, msvcr100.dll, msvcp100.dll, dbghelp.dll, dbgcore.dll, wininet.dll, iphlpapi.dll, version.dll, cryptsp.dll, cryptbase.dll, wldp.dll, profapi.dll, sspicli.dll, winsta.dll, dpapi.dll) from a location other than the standard Windows system directories (C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This behavior is indicative of DLL Search Order Hijacking, where an attacker places a malicious DLL in a directory that is searched before the legitimate system DLLs, causing the application to load the malicious version.
This rule detects when a ClickOnce application loads an unsigned or expired-signature module. ClickOnce applications are typically found in the `\AppData\Local\Apps\2.0\` directory. The detection specifically looks for image load events where the image path matches this ClickOnce application directory pattern and the loaded module's signature status is either 'false' (unsigned) or 'Expired'. This behavior can be indicative of an adversary abusing ClickOnce for trusted code execution, potentially for privilege escalation, defense evasion, or persistence, by injecting or replacing modules with malicious unsigned ones.
Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.
Detects the execution of an executable that is typically used by PlugX for DLL side loading starting from an uncommon location
Detects the use of the Pingback backdoor, which establishes an ICMP tunnel for command and control (C2) communications. The rule specifically looks for the creation of a process where the parent image ends with 'updata.exe' and the command line contains 'config', 'msdtc', 'start', and 'auto'. This combination of parent process and command-line arguments is indicative of the Pingback backdoor's activity as described in the Trustwave report.
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs. This activity may indicate an attempt to sideload arbitrary DLLs into legitimate Microsoft Defender processes, potentially for privilege escalation, persistence, or defense evasion.
Detects the DLL side-loading of 'jli.dll' by 'keytool.exe' from common malware staging directories. This is a more generic version of a rule detecting a technique used by ValleyRAT in Operation Silk Lure.
Detects the creation of specific files associated with the Pingback backdoor, which is known to establish an ICMP tunnel for command and control (C2) communications. The rule specifically looks for 'updata.exe' being created and 'C:\Windows\oci.dll' as the target filename, as described in the Trustwave report.
This rule detects the loading of specific DLL names known to be used by the SVR-attributed GraphicalProton backdoor. The rule looks for an 'ImageLoaded' event where the DLL name ends with one of the predefined malicious DLL names.
This rule detects specific DLL sideloading activity observed to be used by the Diamond Sleet APT group. It looks for the loading of 'Version.dll' by 'clip.exe' or 'DSROLE.dll' by 'wsmprovhost.exe' when these executables and DLLs are located in the 'ProgramData' directory. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their crafted DLLs.
Detects potential DLL sideloading of Python DLL files (python39.dll, python310.dll, python311.dll, python312.dll) by monitoring image load events. The rule filters out legitimate loads from common Python installation paths, Visual Studio, Anaconda, CPython build paths, and PyInstaller bundled applications, as well as legitimately signed Python DLLs, to reduce false positives.
Detects the execution of DLL side-loading malware used by the threat group Emissary Panda, also known as APT27. Specifically, it looks for `svchost.exe` being spawned by `sllauncher.exe` or `svchost.exe` being spawned from a user's `AppData\Roaming` directory with the `-k` command-line argument, which are indicators of this specific malware's behavior.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects potential sideloading of malicious "aclui.dll" by OleView. This behavior was observed in Raspberry-Robin variants reported by Checkpoint Research in February 2024. The rule specifically looks for OleView.exe loading aclui.dll, while filtering out known legitimate paths and signed executables to reduce false positives.
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
Detects when the Code Integrity (CI) engine blocks a process from loading an unsigned DLL that resides in a suspicious location. This often indicates an attempt to bypass security controls or execute malicious code through DLL hijacking or side-loading.
Detects the sideloading of specific trojanized DLLs by legitimate Windows executables, a technique observed in Lazarus APT campaigns targeting a Spanish aerospace company. The rule identifies suspicious DLL loads by monitoring 'ImageLoaded' events for particular DLLs being loaded by specific executables from unusual paths, indicating potential DLL hijacking or sideloading for persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of 'AVKkid.dll' by monitoring image load events. The rule specifically looks for 'AVKkid.dll' being loaded by any process, and then filters out legitimate loads by G DATA antivirus software from its expected installation paths. This helps identify malicious instances where 'AVKkid.dll' might be used for persistence, defense evasion, or privilege escalation outside of its legitimate context.
Page 35 of 48