Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
This rule detects potentially malicious activity on WordPress servers by correlating the creation of a new administrator account via the REST API with subsequent plugin installation activity and the creation of PHP files within the plugin directory within a one-hour window. This sequence is characteristic of an adversary establishing persistence or backdooring a WordPress site after gaining unauthorized access.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects the execution of an executable file stored within an NTFS Alternate Data Stream (ADS) on Windows systems. The rule correlates a process launch from a file path containing an ADS colon syntax with the creation of an anomalous file in the Windows Prefetch directory that masquerades as common image or text file types (png, jpg, jpeg, txt, dat). This behavior is characteristic of adversaries attempting to hide malicious binaries in ADS while interfering with or manipulating system forensic artifacts.
Detects the dropping of the NoEscape ransomware DISKWRITER binary, masquerading as 'winnt32.exe' within the C:\Windows\SysWOW64\ directory. This is identified by the specific file path and hash associated with the known malware threat.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects the creation of a file named 'logAzure.txt' that contains sensitive Microsoft Graph or cloud configuration credentials, such as TenantId, ClientId, ClientSecret, or UserEmail. This activity is indicative of credential staging or exfiltration by malicious actors.
Detects regsvr32 loading chromelevator.ocx/mscom.ocx followed by the ChromEggscalator credential-extraction command sequence.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the creation or renaming of .rbf (Rollback File) files within the C:\Config.Msi directory where the previous filename was 'marker.txt'. This behavior is associated with the Windows Installer service (msiexec.exe) and can be leveraged by adversaries to perform file operations or execute arbitrary code during installation processes.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Page 86 of 217