Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects changes to the PSFactory COM InProcServer32 registry. This technique was used by RomCom to create persistence storing a malicious DLL.
COM Hijack via Sdclt
Sigma
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects potential DLL sideloading using JUSTSYSTEMS Japanese word processor
Detects potential DLL sideloading of "appverifUI.dll"
Detects potential DLL sideloading of "MpSvc.dll".
Detects potential DLL sideloading of "goopdate.dll", a DLL used by googleupdate.exe
Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location
Detects WMI command line event consumers
Detects potential DLL sideloading of "CCleanerDU.dll"
Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
Detects DLL sideloading of VMGuestLib.dll by the WmiApSrv service.
Detects abusing Azure Browser SSO by requesting OAuth 2.0 refresh tokens for an Azure-AD-authenticated Windows user (i.e. the machine is joined to Azure AD and a user logs in with their Azure AD account) wanting to perform SSO authentication in the browser.
An attacker can use this to authenticate to Azure AD in a browser as that user.
An attacker can use this to authenticate to Azure AD in a browser as that user.
Detects potential DLL sideloading of "edputil.dll"
Detects potential DLL sideloading of "vivaldi_elf.dll"
Attempts to load dismcore.dll after dropping it
Detects potential sideloading of "mpclient.dll" by Windows Defender processes ("MpCmdRun" and "NisSrv") from their non-default directory.
Detects potential DLL sideloading of "roboform.dll", a DLL used by RoboForm Password Manager
Detects potential DLL sideloading of "libvlc.dll", a DLL that is legitimately used by "VLC.exe"
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Page 349 of 401