Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the VMware Xfer utility (VMwareXferlogs.exe) from a directory other than its default installation path. This behavior is indicative of an attempt to sideload arbitrary DLLs, often used by adversaries for privilege escalation, persistence, or defense evasion. The rule specifically looks for instances where 'VMwareXferlogs.exe' is executed from a location not starting with 'C:\Program Files\VMware\'.
This rule detects modifications to the Windows Registry keys responsible for DHCP server Callout DLLs. Attackers can leverage this mechanism to install malicious DLLs that execute in the context of the DHCP server, leading to privilege escalation, persistence, and defense evasion. The rule specifically looks for changes to the 'CalloutDlls' and 'CalloutEnabled' values under the 'HKLM\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters' path.
Detects potential DLL sideloading of "DbgModel.dll" when it is loaded from a non-standard or unexpected directory. This rule specifically filters out legitimate loads from common Windows system directories and known application paths like WinDbg and Windows Kits.
This rule detects potential DLL sideloading of "edputil.dll". It specifically looks for instances where "edputil.dll" is loaded from a directory that is not a standard Windows system directory (C:\Windows\System32\, C:\Windows\SysWOW64\, or C:\Windows\WinSxS\). This behavior can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of the legitimate one.
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe. This rule aims to identify instances where this specific DLL is loaded from unexpected or non-standard locations, which could indicate malicious activity such as persistence, defense evasion, or privilege escalation through DLL sideloading.
Detects potential DLL sideloading of "mscorsvc.dll" by identifying instances where this DLL is loaded from a location other than the standard Microsoft .NET Framework or WinSxS directories. This behavior can indicate an attacker attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects DLL sideloading of unsigned "mfdetours.dll". Executing "mftrace.exe" can be abused to attach to an arbitrary process and force load any DLL named "mfdetours.dll" from the current directory of execution. This technique can be used for persistence, defense evasion, and privilege escalation.
This rule detects potential DLL sideloading of 'MpSvc.dll'. It specifically looks for instances where 'MpSvc.dll' is loaded from a location other than the legitimate Windows Defender directories or the WinSxS directory. This technique can be used by adversaries to achieve persistence, escalate privileges, or evade defenses by tricking a legitimate application into loading a malicious DLL.
Detects potential DLL sideloading of 'rcdll.dll' by monitoring image load events. The rule specifically looks for 'rcdll.dll' being loaded from locations other than standard Microsoft Visual Studio or Windows Kits directories, which are considered legitimate paths for this DLL. This activity can indicate an adversary attempting to execute malicious code by tricking a legitimate application into loading a rogue DLL.
Detects the loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary from the "C:\$SysReset\Framework\Stack\" directory. This behavior is suspicious because the "$SysReset" directory is not created by default, suggesting an adversary might be abusing this path for DLL sideloading to achieve persistence, privilege escalation, or defense evasion.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" when "SystemResetPlatform.exe" is executed from a non-default, suspicious location. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "vivaldi_elf.dll" when it is loaded by an executable other than the legitimate Vivaldi browser application. This technique can be used for persistence, defense evasion, and privilege escalation by tricking a legitimate application into loading a malicious DLL.
Detects the use of the PhoneDeepLink parameter with DeviceEnroller.exe to potentially sideload a non-existent DLL file named "ShellChromeAPI.dll". Adversaries can leverage this technique by dropping their own renamed malicious DLL and executing it via DeviceEnroller.exe using this parameter.
Detects potential DLL sideloading of "mpclient.dll" by legitimate Windows Defender processes ("MpCmdRun.exe" and "NisSrv.exe") when they are executed from a non-standard directory. This technique can be used by adversaries to execute malicious code under the guise of a trusted process, potentially leading to privilege escalation, persistence, or defense evasion.
This rule detects attempts to write or modify files within the `C:\Windows\System32\Tasks\` or `C:\Windows\SysWow64\Tasks\` directories using common command-line utilities. Adversaries may leverage the globally writable nature of these folders to achieve privilege escalation, persistence, or defense evasion by loading custom assemblies or scripts into legitimate Windows processes like cscript, wscript, regsvr32, mshta, or eventvwr.
Detects the execution of the Xwizard tool from a non-default directory. When executed from a non-default directory, this utility can be abused to side-load a custom version of "xwizards.dll", which can be used for privilege escalation, persistence, or defense evasion.
Detects potential DLL sideloading of 'roboform.dll' or 'roboform-x64.dll' when loaded by an executable that is not the legitimate RoboForm application (robotaskbaricon.exe or robotaskbaricon-x64.exe) or is loaded from an unexpected path outside of the standard RoboForm installation directories. This technique can be used for persistence, defense evasion, and privilege escalation.
Detects potential DLL sideloading of "ShellDispatch.dll" by monitoring image load events. The rule specifically looks for instances where 'ShellDispatch.dll' is loaded from locations other than typical legitimate temporary directories (like ':\Users\*\AppData\Local\Temp\' or ':\Windows\Temp\'), which could indicate malicious activity.
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus. This rule specifically looks for the loading of 'SmadHook32c.dll' or 'SmadHook64c.dll' by any process other than the legitimate SmadAV executables ('SmadavProtect32.exe' or 'SmadavProtect64.exe') from their expected installation paths.
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") when the DLL is loaded from a non-default or unexpected directory. This technique can be used for privilege escalation, persistence, and defense evasion.
Detects potential Subtle Snail-style DLL side-loading attacks where an unsigned or untrusted DLL is loaded by a signed and trusted parent process from user-writable directories (Downloads, AppData, Temp). This method highlights signature-mismatch scenarios often leveraged by APT and malware actors to stealthily execute malicious code while bypassing traditional defenses.
Page 37 of 48