Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,005 detections
Filters
Last updated
All Time
Detection languages
371
363
66
56
54
Contributors
191
187
115
105
103
Categories
468
262
245
169
116
Platforms
995
21
2
1
1
Products / Services
317
286
46
37
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,005
CVEs
10
5
4
3
2
IDS Classtypes
1
IDS Protocols
1
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
This rule detects when a Common Language Runtime (CLR) DLL, specifically 'clr.dll', is loaded by any of the specified Microsoft Office applications (Excel, Publisher, Outlook, OneNote, PowerPoint, Word). This activity can be indicative of malicious code execution, as adversaries might leverage CLR to execute .NET assemblies within the context of a legitimate Office process, potentially bypassing security controls or achieving persistence.
Detects when a DLL from the Global Assembly Cache (GAC) is loaded by a Microsoft Office application. This behavior can be indicative of malicious activity, such as DLL hijacking or persistence mechanisms, where an attacker might try to load their own malicious DLLs disguised as legitimate GAC assemblies through Office applications.
This rule detects the creation of files with a '.dll' extension that have names matching known Windows system DLLs (e.g., 'secur32.dll', 'tdh.dll') but are created in unusual or non-standard system directories. The rule specifically excludes common legitimate system directories like 'System32' and 'SysWOW64' to reduce false positives. This behavior can indicate an attempt at DLL sideloading or other defense evasion techniques where an attacker places a malicious DLL with a legitimate system DLL name in a location that a legitimate application might load it from.
Detects a potential DLL hijack involving 'iertutil.dll' when loaded by 'iexplore.exe' within the context of the DCOM InternetExplorer.Application Class. This could indicate an adversary attempting to execute malicious code by manipulating the DLL search order or substituting a legitimate DLL.
Detects when 'rundll32.exe' attempts to load a DLL from a remote network path (e.g., a UNC path starting with '\\'). This behavior is often indicative of malicious activity, as legitimate rundll32.exe usage typically involves loading local DLLs.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects PowerShell module creation where the module contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This is indicative of potential abuse of the "RemoteFXvGPUDisablement.exe" binary, which is known to be vulnerable to module load-order hijacking. This technique can be used for defense evasion and proxy execution.
Detects calls to the AtomicTestHarnesses "Invoke-ATHRemoteFXvGPUDisablementCommand" which is designed to abuse the "RemoteFXvGPUDisablement.exe" binary to run custom PowerShell code via module load-order hijacking. This technique leverages a signed binary to proxy execution of malicious code, specifically by exploiting module load-order hijacking to execute PowerShell commands.
Detects a potential privilege escalation attempt by monitoring the creation of specific ".Exe.Local" folders within the "System32" directory. This technique is used to sideload "comctl32.dll" into legitimate Windows processes, which can lead to privilege escalation or persistence.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network, which is a known technique for WMI DLL Hijacking. This specific scenario involves the `System` process, indicating a potential remote write operation followed by the system attempting to load the malicious DLL.
Detects when a legitimate system process, identified by its executable path starting with 'C:\Windows\', loads a Dynamic Link Library (DLL) from a suspicious or permissively permissioned location such as 'C:\Users\Public\' or 'C:\PerfLogs\'. This behavior can indicate an attempt to bypass User Account Control (UAC), achieve persistence, or execute malicious code through DLL side-loading or hijacking techniques.
Detects the execution of the Windows Defender `OfflineScannerShell.exe` from a non-standard directory. This binary is known to be vulnerable to DLL side-loading, specifically loading `mpclient.dll` from its current working directory. An adversary could place a malicious `mpclient.dll` in a non-standard directory and then execute `OfflineScannerShell.exe` from that directory to achieve arbitrary code execution.
Detects a User Account Control (UAC) bypass technique that exploits the 'iscsicpl.exe' process. This bypass leverages DLL Search Order Hijacking to load a malicious 'iscsiexe.dll' from a user-controlled location (e.g., temporary directory or a modified PATH environment variable) instead of the legitimate system directory. The rule specifically looks for 'iscsicpl.exe' loading 'iscsiexe.dll' from any location other than 'C:\Windows\'.
This rule detects the use of 'rasautou.exe' to load and execute arbitrary DLLs. Adversaries can leverage 'rasautou.exe', a legitimate Windows utility, to proxy execution of malicious DLLs by specifying the DLL path with the '-d' option and an export function with the '-p' option. This technique is often used for defense evasion and to bypass application whitelisting. The rule specifically looks for the execution of 'rasautou.exe' or 'rasdlui.exe' with both '-d' and '-p' command-line arguments. This method is primarily relevant for Windows versions prior to Windows 10, as the '-d' and '-p' options were removed in later versions. For effective detection on Windows 7, Sysmon or KB3004375 for command-line auditing is required.
Detects potential DLL sideloading using the Microsoft Office Winword process. This rule specifically looks for the execution of 'WINWORD.exe' with the command-line arguments '/l' and a '.dll' file, which is a known method for arbitrary DLL loading.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network and loading it for a WMI DLL Hijack scenario. This specific rule focuses on `wmiprvse.exe` loading the hijacked `wbemcomn.dll`.
Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation.
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
In it's default mode, it builds a self deleting .bat file which executes malicious command.
The detection rule relies on creation of the malicious bat file (debug.bat by default).
Page 48 of 48