Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
15
10
2
2
1
Contributors
7
7
4
4
3
Categories
18
8
7
6
6
Platforms
32
1
Products / Services
13
9
5
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects DLL files written to common Windows user directories, including Desktop, Downloads, Pictures, Videos, Documents, Music, and other user profile folders. These files may be written by archive extraction utilities such as Windows Explorer, 7-Zip, or WinRAR, web browsers during downloads, or other applications.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
User-accessible directories are common staging locations for files involved in cyberattacks. Attackers may distribute ZIP archives through phishing emails containing a legitimate-looking executable alongside a malicious DLL. After the user extracts the archive and executes the executable, it may load the malicious DLL from the same directory, enabling DLL side-loading and potentially allowing malicious code to execute within a trusted process. Similar activity may occur when DLLs are downloaded or placed directly into other user profile folders.
This detection groups events by endpoint and file path, providing DLL file names, vendor information, SHA256 hashes, the associated process or file context, and the first-seen timestamp to support investigation and triage.
As this is a single-signal detection, it may also identify legitimate software installations, portable applications, development tools, and other benign file operations. Validate the DLL's hash, vendor information, associated process, file location, and source archive or download before escalating the alert.
An attacker can obtain persistence by hijacking the PowerShell cmdlet 'Get-Variable' by placing Get-Variable.exe in the WindowsApps folder, which is part of the PowerShell path.
Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
This activity was first associated with the Colibri malware.
Whenever a PowerShell window is opened via a scheduled task, the malicious Get-Variable.exe will be run.
This activity was first associated with the Colibri malware.
Detects the Cursor IDE (Cursor.exe) executing a process named git.exe from a file path outside of the standard Git installation directory (typically under Program Files). This behavior is indicative of an attacker placing a malicious git.exe binary within a repository directory to facilitate automatic execution and potential command execution when the folder is opened within the IDE, bypassing standard security trust prompts.
Detects arbitrary code execution attempts against Ghidra 12.1.2 by monitoring for suspicious child process spawning from the Ghidra JVM. The rule identifies instances where java.exe, running in a Ghidra-related context, launches unauthorized binary interpreters or tools such as powershell.exe, cmd.exe, or other shell utilities often used as post-exploitation payloads.
Detects anomalous child process execution spawned by ImageMagick binaries. This pattern aligns with exploitation of ImageMagick vulnerabilities where Ghostscript delegates are hijacked via search order manipulation (PATH or working directory) to achieve arbitrary code execution.
This rule detects when a legitimate signed executable loads a DLL from a non-standard or user-writable directory (e.g., AppData, Temp, ProgramData). This behavior is characteristic of DLL search order hijacking, a technique used by various backdoors, including MiniJunk, to gain persistence or execution within a trusted process.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects the execution of wermgr.exe from a non-standard directory, specifically targeting the RoguePlanet junction-hijacking technique where the Windows Error Reporting process is replaced by an attacker-controlled binary under a staging path (e.g., %TEMP%\RP_*).
Detects instances where ImageMagick (magick.exe, convert.exe, or mogrify.exe) launches a Ghostscript executable (gswin64c.exe, gswin32c.exe, gs.exe, or gsx.exe) from a file path outside of the standard installation directories. This behavior is indicative of a Ghostscript delegate path hijacking exploit, which can be leveraged to achieve arbitrary code execution when processing malicious PostScript (PS/EPS) or PDF files.
Detects instances where ImageMagick (magick.exe or convert.exe) spawns Ghostscript (gswin64c.exe, gswin64.exe, or gs.exe) from a directory other than the standard Ghostscript installation path. This behavior is indicative of a search order hijack where an attacker places a malicious binary in a location searched before the legitimate Ghostscript installation.
This rule detects the execution of specific suspicious files (nvdaHelperRemote.dll or Mixed Reality.exe) when they originate from within the 'Windows Media Player' directory. Such behavior is indicative of potential DLL search order hijacking or masquerading attempts, where an adversary places malicious files in a predictable location to intercept execution.
Detects suspicious registry writes to HKLM StaticPluginMap or HKCU CLSID entries that could be used to redirect InstallService plugin loading. Adversaries may modify these registry keys to achieve persistence or defense evasion by hijacking the loading of legitimate plugins.
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects the creation of specific configuration files (`setup.exe.config` or `updateconfig.xml`) that are associated with AppDomain Hijacking techniques used by the Nimbus Manticore threat actor. This activity indicates an attempt to manipulate application configuration to execute malicious code.
Detects using SettingSyncHost.exe to run hijacked binary
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path. This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this legitimate Notepad++ installer. The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
Detects the use of SettingSyncHost.exe to execute a hijacked binary. This technique leverages the legitimate Windows utility SettingSyncHost.exe, which is designed to synchronize settings across devices, to execute arbitrary commands. The rule specifically looks for instances where SettingSyncHost.exe's parent command line contains 'cmd.exe /c', 'RoamDiag.cmd', and '-outputpath', indicating an attempt to run a command-line interpreter to execute a script, while the image itself is not located in standard system directories, suggesting a hijacked execution.
KQL Query from file: Detecting BYOVDLL Abuse
KQL Query
Detects potential exploitation of CVE-2025-49144, a local privilege escalation vulnerability in Notepad++ installers (v8.8.1 and prior) where the installer calls regsvr32.exe without specifying the full path.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
This allows an attacker to execute arbitrary code with elevated privileges by placing a malicious regsvr32.exe alongside this Legitimate Notepad++ installer.
The vulnerability is triggered when the installer attempts to register the NppShell.dll file, which is a component of Notepad++.
KQL Query
Page 1 of 2