Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects potential DLL sideloading of "EACore.dll"
Detects potential DLL sideloading of "dbghelp.dll"
Detects potential DLL sideloading of "CCleanerReactivator.dll"
Detects creation of a malicious DLL file in the location where the OneDrive or Team applications
Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded
Upon execution of the Teams or OneDrive application, the dropped malicious DLL file ("iphlpapi.dll") is sideloaded
Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) from loading unsigned DLLs which may be an attempt to sideload arbitrary DLL
Detects potential DLL sideloading of "AVKkid.dll"
Detects potential DLL sideloading of "wwlib.dll"
Detects loading of a DLL by the VMware Xfer utility from the non-default directory which may be an attempt to sideload arbitrary DLL
Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27
Detects DLL sideloading activity seen used by Diamond Sleet APT
The following analytic detects a process loading a version.dll file from a directory other than %windir%\system32 or %windir%\syswow64. This detection leverages Sysmon EventCode 7 to identify instances where an unsigned or improperly located version.dll is loaded. This activity is significant as it is a common technique used in ransomware and APT malware campaigns, including Brute Ratel C4, to execute malicious code via DLL side loading. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and potentially compromise the target host.
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Detects potential DLL sideloading of Python DLL files.
Detects potential DLL sideloading of "iviewers.dll" (OLE/COM Object Interface Viewer)
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Detects specific process characteristics of Winnti malware noticed in Dec/Jan 2020 in a campaign against Honk Kong universities
Detects the installation of a DNS plugin DLL via ServerLevelPluginDll parameter in registry, which can be used to execute code in context of the DNS server (restart required)
Detects DLL sideloading of DLLs that are loaded by the SCM for some services (IKE, IKEEXT, SessionEnv) which do not exists on a typical modern system
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
IKEEXT and SessionEnv service, as they call LoadLibrary on files that do not exist within C:\Windows\System32\ by default.
An attacker can place their malicious logic within the PROCESS_ATTACH block of their library and restart the aforementioned services "svchost.exe -k netsvcs" to gain code execution on a remote machine.
Detects specific process characteristics of Winnti Pipemon malware reported by ESET
Detects the use of Pingback backdoor that creates ICMP tunnel for C2 as described in the trustwave report
Page 41 of 48