Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
15
5
4
2
1
Contributors
9
8
3
2
2
Categories
10
8
8
7
4
Platforms
27
1
Products / Services
14
7
2
1
1
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
1
IDS Protocols
1
Detects the trusted .NET host used in Blinder Tunnel to run an attacker-supplied AppDomainManager: a renamed signed Visual Studio hosting binary as RuntimeBroker.exe, or vshost32.exe for the Blackwood tunneling tool. The attacker’s <host>.exe .config names the malicious DLL, which loads before any host code. The genuine RuntimeBroker.exe only runs from System32, and the \Microsoft\RuntimeBrokers\ install folder does not exist on a clean Windows install. The path arm therefore still fires if the actor renames the host. A LaunchContext field separates first execution (MSBuild/devenv .csproj trigger or Inno Setup installer) from Explorer autostart.
Detects the Blackwood tunneling tool from Blinder Tunnel. Blackwood.dll is sideloaded into a signed vshost32.exe via its .config and reflectively loads Go-compiled Chisel, which dials a raw public IP and opens a reverse SOCKS proxy for lateral pivoting.
Detects the creation of .exe.config files by potentially unauthorized or suspicious processes. Attackers may use these configuration files to hijack the .NET AppDomainManager, enabling malicious code execution when the associated executable is launched. The rule monitors file creation events (Sysmon Event ID 11) and filters out expected installers or update processes while flagging suspicious writing processes like PowerShell, CMD, or non-standard binaries.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects a suspicious execution chain where a dropper (chrome_setup.exe) uses an AppDomainManager injection technique to load a malicious DLL, followed by the execution of the TinyRCT payload (PerfWatson2.exe) from the LocalAppData directory. This behavior has been observed in campaigns targeting Southeast Asian government and critical infrastructure.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
This rule detects AppDomainManager injection attempts by monitoring for the loading of suspicious DLLs (related to AppDomainManager functionality) by specific processes or from unexpected file paths. The rule specifically targets attempts to hijack the .NET AppDomainManager class by checking against known suspicious filenames and excluding legitimate .NET framework directories, which is a common technique used for arbitrary code execution in the context of a target process.
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects the spawning of DllHost.exe (a Windows COM surrogate process) by identified STOCKSTAY malware components or via suspicious msiexec installations targeting STOCKSTAY directories. This behavior is indicative of inter-process communication (IPC) used by Turla's STOCKSTAY malware suite.
Detects .NET AppDomainManager injection, a technique used by the Turla threat group (specifically STOCKSTAY.MARKETMAKER), by monitoring registry modifications to the .NETFramework key. An attacker can set AppDomainManagerAssembly and AppDomainManagerType to force the Common Language Runtime (CLR) to load a malicious DLL whenever a .NET process starts, facilitating persistent code execution.
This rule detects suspicious activity associated with the TinyRCT malware, specifically identifying the loading of 'MyAppDomainManager.dll' in unexpected process paths or in conjunction with 'chrome_setup.exe'. It also monitors for 'PerfWatson2.exe' instances executing outside of the expected local application data directory, which is a known indicator of this campaign's persistence and execution behavior.
Detects deployment of AppDomainManager hijack assemblies for .NET execution
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Identifies the creation of a .config file matching a newly relocated executable's name, used to force the .NET runtime to load the TOTPGuard.dll AppDomainManager. This rule specifically looks for the simultaneous creation of an executable (.exe) and a corresponding configuration file (.exe.config) in the same directory, which is a known technique used by the Nimbus Manticore threat actor for AppDomainManager hijacking.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects malicious .config modifications suppressing ETW telemetry and bypassing strong name verification, indicative of the Screening Serpens activity. The rule specifically looks for file modifications to .config files that include specific strings related to disabling ETW and bypassing strong name verification, combined with process command line arguments containing these same strings.
Page 1 of 2