Detectors

6 detectors match the current filters. tactic: TA0005 ✕ technique: T1574 ✕

Download CSV

Type	Name	Severity	Module	Data source / event	ATT&CK
Analytics BIOC	A rare DLL, signed by an uncommon vendor, was hijacked into a Microsoft process A signed DLL was loaded into a Microsoft-signed process. This DLL hash and signature vendor are rare, which might indicate an attacker performing DLL hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Globally uncommon image load from a signed process A signed process loaded a DLL that, on a global level, it usually doesn't load.	Informational	Platform Analytics	XDR Agent	Defense Evasion
Analytics BIOC	Modification of the AD FS IdentityServer configuration file The AD FS service configuration file was modified.	Informational	Identity Analytics	XDR Agent with eXtended Threat Hunting (XTH)	Persistence, Defense Evasion
Analytics BIOC	Possible DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. This DLL name is usually signed by Microsoft, which might indicate an attacker performing DLL Hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Unsigned DLL Hijack into a Microsoft process An unsigned DLL was loaded into a Microsoft signed process. It is not common for the DLL to be loaded into Microsoft processes, which might indicate an attacker performing DLL Hijacking.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion
Analytics BIOC	Unsigned DLL Side-Loading A signed process loaded an unsigned and rare module from the same folder.	Informational	Platform Analytics	XDR Agent	Persistence, Privilege Escalation, Defense Evasion