Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. This behavior is significant as adversaries often exploit DLL side-loading to execute malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information.
The analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. This is identified using Sysmon EventCode 7, which logs DLL loads, and filters out legitimate system paths. This activity is significant as it may indicate exploitation of CVE-2021-41379 or DLL side-loading attacks, both of which can lead to unauthorized system modifications. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or persist within the environment.
This analytic detects the use of `mavinject.exe` for DLL injection into running processes. It specifically looks for command-line parameters such as `/INJECTRUNNING` and `/HMODULE`. This activity indicates potential arbitrary code execution, a common tactic for malware deployment and persistence. If confirmed malicious, this could allow attackers to execute unauthorized code, escalate privileges, and maintain persistence within the environment, posing a severe security risk.
This analytic detects suspicious DLL modules loaded by calc.exe that are not located in the %systemroot%\system32 or %systemroot%\sysWoW64 directories. This detection leverages Sysmon EventCode 7 to identify DLL side-loading, a technique often used by Qakbot malware to execute malicious DLLs. This activity is significant as it indicates potential malware execution through a trusted process, which can bypass security controls. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and escalate privileges within the environment.
The following analytic identifies the creation of Dynamic Link Libraries (DLLs) with a known history of exploitation in atypical locations. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and filesystem events. This activity is significant as it may indicate DLL search order hijacking or sideloading, techniques used by attackers to execute arbitrary code, maintain persistence, or escalate privileges. If confirmed malicious, this activity could allow attackers to blend in with legitimate operations, posing a severe threat to system integrity and security.
The analytic detects the abuse of SqlWriter and SQLDumper executables to sideload the vcruntime140.dll library. It leverages Sysmon EventCode 7 logs, focusing on instances where SQLDumper.exe or SQLWriter.exe load vcruntime140.dll, excluding legitimate loads from the System32 directory. This activity is significant as it indicates potential DLL sideloading, a technique used by adversaries to execute malicious code within trusted processes. If confirmed malicious, this could allow attackers to execute arbitrary code, maintain persistence, and evade detection by blending with legitimate processes.
The following analytic detects when DLLs with known abuse history are loaded from an unusual location. This activity may represent an attacker performing a DLL search order or sideload hijacking technique. These techniques are used to gain persistence as well as elevate privileges on the target system. This detection relies on Sysmon EID7 and is compatible with all Official Sysmon TA versions.
The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk.
The following analytic detects the creation of potentially malicious unsigned DLLs in the c:\windows\system32 or c:\windows\syswow64 folders. It leverages Sysmon EventCode 7 logs to identify unsigned DLLs with unavailable signatures loaded in these critical directories. This activity is significant as it may indicate a DLL hijacking attempt, a technique used by attackers to gain unauthorized access and execute malicious code. If confirmed malicious, this could lead to privilege escalation, allowing the attacker to gain elevated privileges and further compromise the target system.
The analytic detects DLL search order hijacking involving `iscsicpl.exe`. It identifies when `iscsicpl.exe` loads a malicious DLL from a new path, triggering payload execution. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on child processes spawned by `iscsicpl.exe`. This activity is significant as it indicates a potential attempt to execute unauthorized code via DLL hijacking. If confirmed malicious, this could allow an attacker to execute arbitrary code, escalate privileges, or maintain persistence within the environment.
This analytic identifies suspicious child processes spawned by calc.exe, indicative of DLL side-loading techniques. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, and parent processes. This activity is significant as it is commonly associated with Qakbot malware, which uses calc.exe to load malicious DLLs via regsvr32.exe. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and escalate privileges, posing a severe threat to the environment.
The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. It leverages the Endpoint.Filesystem datamodel to identify instances where these files are created outside their expected directories. This activity is significant because it is associated with the REvil ransomware, which uses DLL side-loading to execute malicious payloads. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion.
Detects the modification of the "Ime File" registry value within the Keyboard Layouts key to point to suspicious folders. This technique can be used by attackers to load a malicious DLL into a process after sending a WM_INPUTLANGCHANGEREQUEST message, leveraging the Windows Input Method Editor (IME) feature for persistence or defense evasion. The rule specifically looks for DLL paths located in common temporary or user-writable directories, which are often abused by malware.
Detects the execution of "Extexport.exe", a utility that is part of the Internet Explorer browser. This utility can be abused for DLL sideloading, specifically by loading "mozcrt19.dll", "mozsqlite3.dll", or "sqlite.dll" if a folder is provided in the command line, or arbitrary DLLs if specific flags are used. This behavior is associated with malware like Astaroth and Guildma.
Detects the loading of a malicious 'version.dll' from the 'C:\Windows\ADFS\' directory, a technique used by the NOBELIUM threat group with their FoggyWeb backdoor to achieve DLL hijacking.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.
Detects a suspicious DLL load by an "svchost" process based on location and name that might be related to ColdSteel RAT. This DLL location and name has been seen used by ColdSteel as the service DLL for its persistence mechanism.
Detects potential DLL hijack of "iertutil.dll" found in the DCOM InternetExplorer.Application Class over the network. This rule specifically looks for file events where the 'System' process is writing to 'iertutil.dll' within the 'Internet Explorer' directory, which could indicate an attempt to replace or modify a legitimate DLL for malicious purposes, potentially leveraging DCOM for remote execution.
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Page 47 of 48