Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
168 detections
Filters
Last updated
All Time
Detection languages
62
43
26
16
10
Contributors
88
21
15
11
8
Categories
68
66
48
43
21
Platforms
167
1
Products / Services
83
44
19
10
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
Detects the loading of DLLs by signed processes from suspicious, user-writable, or known staging directories associated with malware loaders like HijackLoader. The rule monitors for module load events involving paths such as AppData, ProgramData, and user profile subdirectories, while excluding known legitimate publishers and paths.
Detects DLL side-loading attempts and suspicious process executions associated with the HijackLoader (wingo) malware distribution chain. The rule monitors for specific common applications loading known vulnerable DLLs from suspicious non-standard directories (e.g., ProgramData, Temp) and tracks rare parent-child process relationships associated with this campaign.
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects DLL search-order hijacking where potentially malicious or unauthorized versions of common application DLLs (such as those from Opera or Qt5 framework) are loaded from non-standard locations like %TEMP%, %AppData%, or user-writable directories instead of their legitimate installation paths. This technique is often associated with loaders like HijackLoader/CastleLoader to execute arbitrary code within the context of a legitimate process.
This rule detects potential process injection activities associated with the HijackLoader (IDAT Loader) malware family. It monitors Sysmon event logs for sequences involving process creation, image loading, and inter-process manipulation, specifically flagging the use of CreateRemoteThread, QueueUserAPC, and process access patterns (such as writing thread rights) indicative of reflective DLL injection used to deliver payloads like Vidar.
Detects DLL side-loading techniques associated with Operation Turb00. This rule monitors specific legitimate applications ('WizardDa42.exe' and 'AlphVector.exe') as they load known trojanized DLLs ('Qt5Core.dll', 'WebView2Loader.dll', 'opera_elf.dll') from staging directories like 'C:\ProgramData\extadvanced_arm64\' or the user's TEMP directory, while excluding loads from standard 'Program Files' locations.
Detects DLL sideloading and suspicious module loading by legitimate signed executables from user-writable directories (e.g., AppData, Temp). This covers known techniques used in campaigns like TA4922, targeting executables such as AnyDesk and vulkaninfo.exe to load unauthorized DLLs.
Detects DLL side-loading activities where the legitimate Radmin VPN executable loads an unsigned or malicious Qt5Core.dll from its local directory, or creates anomalous XML files that function as PNG-IDAT steganography containers. This behavior is associated with HijackLoader (IDAT Loader) malware infection chains.
Detects DLL sideloading activity where legitimate, signed binaries such as ADNotificationManager.exe or QEMU-related executables (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe) load malicious DLLs (e.g., vcruntime140_1.dll) from user-writable directories (e.g., AppData, Temp, ProgramData). This behavior is associated with the GOLD ENCOUNTER and STAC campaigns for delivering payloads like Havoc C2.
Detects instances where the legitimate Windows binary 'consent.exe' loads the library 'msimg32.dll' from a non-standard location (outside of System32 or SysWOW64). This behavior is characteristic of DLL sideloading techniques used by the BumbleBee malware loader to execute malicious code within the context of a trusted system process.
Detects DLL sideloading behavior where 'Mixed Reality.exe' loads the 'nvdaHelperRemote.dll' library from the Windows Media Player directory, rather than the legitimate NVDA installation path. This is a characteristic indicator of the Silver Fox threat activity associated with Operation DragonReturn.
Detects LegionLoader malware activity involving the creation of known-malicious DLLs (7z.dll, normaliz.dll, msvcr90.dll) or the malicious batch script 'xupdate.bat' within non-standard subdirectories of AppData\Roaming. This behavior is indicative of DLL sideloading used to maintain persistence or execute malicious payloads.
Detects suspicious behavior associated with ADNotificationManager.exe, including DLL side-loading of vcruntime140_1.dll, loading of DLLs from user-writable directories (potential DLL hijacking), and the spawning of Rclone.exe for potential data exfiltration via SFTP.
Detects DLL sideloading patterns associated with OceanLotus (APT32), specifically targeting known sideloaded module filenames or legitimate processes loading modules from user-writable and non-standard directories using suspicious command-line flags.
Detects the execution of a potentially malicious fltMC.exe from the user's TEMP directory, a technique utilized by the Red Lamassu actor to sideload the JFMBackdoor. This rule monitors for known malicious file hashes or the execution of fltMC.exe from suspicious locations where the legitimate System32 binary should not reside.
Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.
Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.
Detects the loading of 'nvdaHelperRemote.dll' or 'nvdaHelper64.dll' by any process other than 'nvda.exe', or when loaded from outside the legitimate NVDA installation directory. This pattern is commonly used in DLL sideloading attacks to execute arbitrary code, as observed in Operation DragonReturn.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Page 1 of 8