Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the Kothamine dropper chain by correlating network connections or command-line activity fetching payloads from a specific GitHub repository ('cphc811-ui/new-tails') with the subsequent creation of associated malicious files (e.g., tailscale-related binaries, injector DLLs) on the same host within a one-hour window.
This rule detects the Kothamine dropper chain by correlating network connections or command-line activity fetching payloads from a specific GitHub repository ('cphc811-ui/new-tails') with the subsequent creation of associated malicious files (e.g., tailscale-related binaries, injector DLLs) on the same host within a one-hour window.
Detects anomalous file manipulation behavior consistent with the Kothamine agent, characterized by rapid create, write, and delete cycles on a single file. The detection specifically targets processes identified as either explorer.exe with a reflected Kothamine DLL module or the standalone MicrosoftEdgeUpdateCore.exe loader running from an AppData staging path.
Detects anomalous file manipulation behavior consistent with the Kothamine agent, characterized by rapid create, write, and delete cycles on a single file. The detection specifically targets processes identified as either explorer.exe with a reflected Kothamine DLL module or the standalone MicrosoftEdgeUpdateCore.exe loader running from an AppData staging path.
Detects anomalous file manipulation behavior consistent with the Kothamine agent, characterized by rapid create, write, and delete cycles on a single file. The detection specifically targets processes identified as either explorer.exe with a reflected Kothamine DLL module or the standalone MicrosoftEdgeUpdateCore.exe loader running from an AppData staging path.
Detects sequential suspicious SMB activity characteristic of PsExec lateral movement: connection to ADMIN$ or C$ administrative shares, followed by the upload of an executable or batch file to the share, and subsequently the usage of SVCCTL (CreateServiceW/StartServiceW) to execute the uploaded binary.
Detects an exploitation chain in RouterOS where an attacker triggers an SSH rekey before authentication completes, forcing the SSH server into a post-authentication state. This allows the attacker to execute arbitrary commands over an unauthenticated channel, leading to unauthorized creation, modification, or reconstruction of sensitive system and configuration files.
Detects repeated file creation or modification events involving the specific file 'bot_log.txt' in directory paths containing '\Temp\' on endpoints where 'msedge_proxy.exe' is also running. This pattern is indicative of potential data staging or logging activities by an unauthorized proxy or tunnel process.
Detects anomalous child process execution (e.g., shells, curl, python) or the creation of web-accessible script files (.jsp, .php, .aspx) originating from common VPN gateway or edge appliance service processes. This behavior is indicative of potential exploitation of a remote-facing appliance or webshell deployment.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects the presence of the 'SOUL.md' configuration file associated with the Hermes Agent AI framework. This file contains a specific 'GH0ST' persona prompt designed to bypass ethical restrictions (jailbreak) and configure the agent for automated post-exploitation tasks, such as loot collection and Telegram-based command and control.
Detects the creation of files containing AI provider API keys within the /root/.hermes/loot/ directory, consistent with credential harvesting behavior observed by the CARBONATO GH0ST agent.
Detects a coordinated attack sequence where a browser process is terminated, followed immediately by the execution of an unsigned Python interpreter from a suspicious location (temp/downloads folder), which is then followed by the installation of an unsigned browser extension. This pattern mimics ClickFix and browser-based RAT lure campaigns.
Detects the deployment and operational artifacts associated with the Hermes Agent framework using the CARBONATO GH0ST persona on Linux systems. This detection focuses on identifying specific file-system indicators, including persona configuration files (SOUL.md), loot staging directories, and deployment entry scripts (entry.sh or CARBONATO_API_KEY artifacts) that indicate malicious activity and potential AI-driven Telegram command and control (C2) staging.
Detects malicious staging and C2 activity characteristic of RatHat Android malware. The rule identifies processes running under the Android shell user (UID 2000) that execute specific tools (minicap, minitouch, or disguised libraries) from the /data/local/tmp directory, followed by an outbound network connection, which is indicative of a persistence mechanism and reverse-tunneling command-and-control communication.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects indicators of RMMCRAT malware installation, which masquerades as JivaChat software. The rule identifies suspicious process execution (e.g., rmm.exe), specific file artifacts created in ProgramData, and persistence mechanisms including Windows service registration, 'Load' registry value abuse, and a unique COM CLSID hijack. The logic enforces corroboration across different signal types (process, file, registry) or triggers on the unique CLSID.
Detects UNC6240 PSEMHUB.war web shell/tunnel/trojanized installer artifacts by distinctive content markers (x.jsp, u.jsp, tunnel.jsp/jspx, Ple64.exe)
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects the copying of the legitimate Windows curl.exe binary to a renamed filename within user-writable directories (e.g., %TEMP%) via PowerShell. This technique is often used to masquerade the utility for stealthy file downloads. The rule also identifies the execution of these renamed binaries by checking for a mismatch between the current filename and the binary's original file description embedded in its PE header.
Page 17 of 217