Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects a DHCP server error where a specified Callout DLL, configured in the registry, could not be loaded. This event can indicate an attempt to inject a malicious DLL into the DHCP server process for persistence, privilege escalation, or defense evasion.
This rule detects when a DHCP server loads a specified Callout DLL, which can be abused for persistence, privilege escalation, or defense evasion. Adversaries might inject malicious DLLs into legitimate processes like the DHCP server to maintain access or elevate privileges on a system.
This rule detects the execution of 'vmnat.exe' when its filename has been changed. Adversaries may rename legitimate executables to evade detection, especially when attempting DLL side-loading. The rule specifically looks for processes where the original filename is 'vmnat.exe' but the executed image file path does not end with 'vmnat.exe'. This behavior could indicate an attempt to leverage a legitimate, signed executable for malicious purposes, such as DLL side-loading, where a malicious DLL is placed in the same directory as the renamed legitimate executable.
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
Detects potential DLL sideloading of "appverifUI.dll" when loaded by an 'appverif.exe' process from a non-standard or suspicious location. This rule aims to identify instances where an attacker might place a malicious 'appverifUI.dll' in a directory that 'appverif.exe' would load before its legitimate counterpart, leading to execution of the malicious DLL.
Detects potential DLL sideloading of "waveedit.dll" when loaded by an executable outside of the legitimate Nero WaveEditor installation paths. This technique is often used by adversaries for persistence, privilege escalation, and defense evasion.
This rule detects potential DLL sideloading attempts using the 'coregen.exe' (Microsoft CoreCLR Native Image Generator) binary. It specifically looks for instances where 'coregen.exe' loads DLLs from locations other than the legitimate Microsoft Silverlight or Windows system directories (System32, SysWOW64). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate, signed Microsoft binary into loading their arbitrary DLL.
Detects potential DLL side loading of "KeyScramblerIE.dll" by "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Various threat actors and malware have been found side loading a masqueraded "KeyScramblerIE.dll" through "KeyScrambler.exe".
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in the registry using dnscmd.exe, which can be used to execute code in the context of the DNS server (restart required). This technique can be used for privilege escalation or persistence.
Detects the execution of 'register-cimprovider.exe' with command-line arguments indicating an attempt to register a DLL. This technique can be used by adversaries to achieve persistence, privilege escalation, or defense evasion by loading malicious DLLs through a legitimate Windows binary.
Detects potential DLL sideloading of 'iviewers.dll' (OLE/COM Object Interface Viewer) when it is loaded from a location other than the legitimate Windows Kits directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "SolidPDFCreator.dll" when loaded by an executable other than "SolidPDFCreator.exe" or from an unexpected directory. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of 'wwlib.dll' by identifying instances where 'wwlib.dll' is loaded by an executable that is NOT a legitimate Microsoft Office Word process. This rule specifically filters out loads from standard Microsoft Office installation paths for 'winword.exe' to reduce false positives.
Detects the installation of a DNS plugin DLL by monitoring modifications to the 'ServerLevelPluginDll' registry parameter. This technique can be used by adversaries to execute arbitrary code within the context of the DNS server, often requiring a restart of the DNS service to take effect. This can lead to privilege escalation and persistence on a compromised system.
Detects potential DLL side-loading used by the AdaptixC2 framework, where a malicious DLL is dropped into the C:\Windows\Tasks directory, followed by the execution of a copied msdtc.exe from the same location.
This rule detects potential DLL sideloading of 'EACore.dll'. It specifically looks for instances where 'EACore.dll' is loaded by an executable, but the executable or the loaded DLL is not from the legitimate 'C:\Program Files\Electronic Arts\EA Desktop\EACoreServer.exe' path. This technique can be used by adversaries for persistence, defense evasion, and privilege escalation by tricking legitimate applications into loading malicious DLLs.
Detects potential DLL sideloading of "mfdetours.dll" when loaded by a process other than the legitimate "mftrace.exe" from its expected path. This technique can be abused to force load a malicious DLL named "mfdetours.dll" from the current directory of execution, allowing for persistence, privilege escalation, or defense evasion.
This rule detects attempts to exploit a DLL search order hijacking vulnerability in the Windows Fax service. Specifically, it looks for instances where the 'fxssvc.exe' process attempts to load 'ualapi.dll' from a location other than the legitimate Windows system directories (e.g., 'C:\Windows\WinSxS\'). This indicates that an attacker may have placed a malicious 'ualapi.dll' in a directory that the Fax service searches before the legitimate system path, leading to the execution of the attacker's code.
Detects the loading of 'glib-2.0.dll' by the 'VMwareXferlogs.exe' utility from a directory other than the default VMware installation path. This behavior is indicative of potential DLL sideloading, where an attacker might place a malicious DLL in a non-standard location to be loaded by a legitimate application, often for privilege escalation, persistence, or defense evasion.
Detects the loading and execution of an unsigned Thor scanner binary. This rule specifically looks for 'thor.exe' or 'thor64.exe' being loaded, and then filters out instances where the binary is legitimately signed by 'Nextron Systems GmbH' with a valid signature status. This helps identify potentially malicious or unauthorized versions of the Thor scanner.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification. This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Page 36 of 48