SigmaHQ Detections
@sigmaHQ12 followers122,429 downloads2,479 copies16 likes159,603 views
6,797 detections
Filters
Last updated
All Time
Detection languages
6,797
Categories
2,695
910
506
407
372
Platforms
5,313
505
263
203
164
Products / Services
2,050
1,570
475
423
316
MITRE Techniques
2,652
1,738
1,655
1,502
764
CVEs
19
19
19
16
10
Detects potential DLL sideloading of Python DLL files.
Detects potential DLL sideloading of rcdll.dll
Detects loading of "RjvPlatform.dll" by the "SystemResetPlatform.exe" binary which can be abused as a method of DLL side loading since the "$SysReset" directory isn't created by default.
Detects potential DLL sideloading of "RjvPlatform.dll" by "SystemResetPlatform.exe" located in a non-default location.
Detects processes loading the non-existent DLL "ShellChromeAPI". One known example is the "DeviceEnroller" binary in combination with the "PhoneDeepLink" flag tries to load this DLL.
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Adversaries can drop their own renamed DLL and execute it via DeviceEnroller.exe using this parameter
Detects potential DLL sideloading of "ShellDispatch.dll"
Detects potential DLL sideloading of "SmadHook.dll", a DLL used by SmadAV antivirus
Detects DLL sideloading of DLLs that are part of third party software (zoom, discord....etc)
The Fax service attempts to load ualapi.dll, which is non-existent. An attacker can then (side)load their own malicious DLL using this service.
Detects potential DLL sideloading of "vivaldi_elf.dll"
Page 105 of 680