Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
This rule detects activities associated with the SmartLoader malware, including the creation or renaming of specific files (ODE3.exe, Module.class, Lua51.dll) in suspicious user application data directories, the creation or update of scheduled tasks with a specific name ("SecurityHealthService_ODE3"), and the DLL sideloading of "lua51.dll". These activities indicate potential execution, persistence, and defense evasion by the SmartLoader malware.
Detects when 'msimg32.dll' is loaded from a non-standard directory, which can be an indicator of DLL hijacking.
Detects potential DLL side-loading where the legitimate Palo Alto Networks executable 'PanGpHip.exe' is launched from a non-standard directory and loads 'libwaapi.dll' from the same path. This behavior is consistent with the technique described in the dmpdump report, where an LNK file executes the legitimate application to load a malicious DLL.
Detects the loading of `libcef.dll` by `vcpktsvr.exe` from non-standard directories. This specific DLL Sideloading behavior is a key tactic of the malware associated with the Termncolor/Colorinal malicious Python packages, where a legitimate executable is dropped into an unusual location to load a malicious DLL.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects the DLL sideloading of `jli.dll` by `java.exe` from common malware staging directories. This technique was observed being used by ReadNimeLoader as part of a BlackBasta-associated campaign.
This detection identifies suspicious DLL loads by SpeechRuntime.exe from outside the expected system directories. SpeechRuntime is vulnerable to a COM hijacking attack that allows an attacker to execute code remotely and stealthily by exploiting a Windows COM class. By altering the registry to point to a malicious DLL and then triggering the COM object, the attacker can cause the malicious DLL to load into SpeechRuntime.exe and execute in the user's context.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.
Detects potential DLL Sideloading activity as used by LockBit ransomware operators. This rule identifies when a legitimate, signed application (e.g., MpCmdRun.exe, jarsigner.exe) loads a corresponding DLL from the same, non-standard directory, a common TTP for defense evasion.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This rule detects potential DLL sideloading attempts by monitoring the loading of specific DLLs (version.dll and rtworkq.dll) from non-standard Windows system directories. It specifically looks for these DLLs being loaded by 'icardagt.exe' or 'mfpmp.exe' processes outside of 'C:\Windows\System32\' or 'C:\Windows\SysWOW64\'. This behavior is indicative of an adversary attempting to execute malicious code by tricking legitimate applications into loading their malicious DLLs instead of the legitimate ones.
Akira SonicWall Campaign - Detects the creation or presence of malicious drivers (hlpdrv.sys, rwdrv.sys) or the creation of their associated Windows services.
Detects malicious DLLs (ffmpeg.dll, libvlc.dll) used for sideloading by a China-nexus APT in the 'Illusory Wishes' campaign targeting the Tibetan community.
Detects the DLL sideloading of malicious DLLs (ffmpeg.dll, libvlc.dll) by legitimate applications (Element.exe, VLC.exe) as observed in the 'Illusory Wishes' campaign.
Detects techniques used by the Dropping Elephant APT group to stage and execute a DLL side-loading attack using VLC Media Player. This includes the execution of VLC from suspicious paths, the use of PowerShell to download and rename payloads into those paths, and the specific scheduled task used for persistence.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Page 39 of 48