Detection catalogue

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

detections

Loading detections…

DLL Load By System Process From Suspicious Locations

Detects when a system process (i.e. located in system32, syswow64, etc.) loads a DLL from a suspicious location or a location with permissive permissions such as "C:\Users\Public"

ATT&CK coverage

Outside the enterprise matrix

T1070

Detection requirements

Log source product: windows
Log source category: image_load

What the source says

What fires this without an attack behind it

Unknown

References

https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC (Idea)

Tagged by the source as

attack.stealth

Detection logic

Published to signed-in readers

The query as its source wrote it, its canonical form, and the content hash that pins this exact revision.