Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects dll-sideloading attempts via licensingdiag.exe
SPL Query
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query
KQL Query
KQL Query
Detects DLL sideloading of DLLs usually located in system locations (System32, SysWOW64, etc.).
Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospace company
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects potential DLL side loading of DLLs that are part of the Wazuh security platform
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential DLL sideloading using ClassicExplorer32.dll from the Classic Shell software
Detects Loading of samlib.dll, WinSCard.dll from untypical process e.g. through process hollowing by Mimikatz
Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanetsvc.exe" process using DLL Search Order Hijacking
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
Suspicious GUP Usage
Sigma
Detects execution of the Notepad++ updater in a suspicious directory, which is often used in DLL side-loading attacks
Tasks Folder Evasion
Sigma
The Tasks folder in system32 and syswow64 are globally writable paths.
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Adversaries can take advantage of this and load or influence any script hosts or ANY .NET Application
in Tasks to load and execute a custom assembly into cscript, wscript, regsvr32, mshta, eventvwr
Page 40 of 48