Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
This rule detects potential malicious activity by matching endpoint file events against a known list of malicious file hashes (SHA256, SHA1, MD5) and monitoring for connections to known malicious domains or URLs.
Detects the presence of a specific, hardcoded Ed25519 public key associated with malicious cross-platform payloads (npm, Go modules, Terraform providers) that use Slack for C2 communication.
This rule detects the suspicious use of signed Windows binaries (rundll32.exe, regsvr32.exe, mshta.exe, msiexec.exe) to execute remote content via URLs or scripts, or when triggered by common office applications and browsers. This behavior is often indicative of living-off-the-land (LotL) techniques used for download/execution of payloads or bypassing security controls.
This rule monitors for persistence mechanisms by detecting modifications to Windows Registry Run/RunOnce keys or the creation of files within the Windows Startup folder. It specifically flags instances where the executable or script being registered resides in high-risk directories such as Temp, AppData, or Downloads, and correlates these events with recent process execution to confirm the persistence activity.
KQL Query from file: JivaChat Installer - Full Chain
Detects the presence of the Amatera secondary-payload archive component, which consists of a legitimate signed Chrome executable (platform_experience_helper.exe) paired with a malicious NativeAOT-compiled Secur32.dll designed for DLL side-loading. The malicious DLL is identified by its interaction with the GetUserNameExW Windows API.
Sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceNetworkEvents over a rolling 30-day window for known RevStealer indicators: exact SHA-256 matches against all 13 published file hashes, and exact-host matches (via parsed URL host, not substring) against the confirmed C2 domain meta7.archscreen68.one. An empty, extensible IP list is included for when a malicious IP is published.
This rule detects potential command and control or malicious file staging activity by correlating DNS TXT record queries (often used for data exfiltration or staging configuration) performed by common system utilities (nslookup, PowerShell) with the subsequent execution of files from suspicious directories (Downloads, Temp) within a 30-minute window on the same device.
Detects the execution of programs directly from the root of a removable or virtual drive (e.g., ISO, IMG, VHD) via explorer.exe. This activity is a hallmark of phishing attacks that leverage container mounting to bypass Mark-of-the-Web (MOTW) security protections, as files extracted from or executed within mounted containers often fail to inherit MOTW metadata.
Detects the presence of the i-Realm companion tool associated with the AnonyMousKIT PhaaS platform, which is designed to bypass iOS Activation Lock features.
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
Detects a malicious payload masquerading as a ClaudeDesktop installer that uses DLL sideloading via a tampered libcef.dll and a repurposed JetBrains binary to execute the SectopRAT .NET RAT.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects the use of a malicious 'borlndmm.dll' file intended for DLL side-loading to deploy the OnyxC2 stealer payload. The rule identifies files masquerading as NVIDIA graphics libraries or Borland memory managers that contain embedded encrypted payloads, matching known indicators for OnyxC2 activity.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Page 16 of 80