MITRE ATT&CK technique
Shared Modules detection rulesT1129
Shared Modules (T1129) is a MITRE ATT&CK technique in the Execution tactic. This page lists the 2 community-maintained Sigma detection rules in the library mapped to T1129 and its sub-techniques. Each rule includes its detection logic, log source, false positives and original YAML. These rules mainly target windows.
Katz Stealer DLL Loaded
highDetects loading of DLLs associated with Katz Stealer malware 2025 variants. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. The process that loads these DLLs are very likely to be malicious.
windows · image_load
Unsigned .node File Loaded
mediumDetects the loading of unsigned .node files. Adversaries may abuse a lack of .node integrity checking to execute arbitrary code inside of trusted applications such as Slack. .node files are native add-ons for Electron-based applications, which are commonly used for desktop applications like Slack, Discord, and Visual Studio Code. This technique has been observed in the DripLoader malware, which uses unsigned .node files to load malicious native code into Electron applications.
windows · image_load