Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
Detects endpoint behavior consistent with AI-assisted exploit development, characterized by the execution of reverse engineering and vulnerability research tools (e.g., IDA Pro, Ghidra, AFL) interleaved with frequent outbound network connections to LLM APIs, followed by the local compilation of a new executable or DLL.
This rule identifies potential infections associated with the MacSync malware family by matching process, file, and network indicators (hashes, malicious domains, and specific payload URLs) against endpoint telemetry. It monitors for execution of known malicious binaries, file creation events, and communication with identified command-and-control infrastructure.
Detects file hash hits matching known malicious IOCs or network connections to suspicious domains/URLs.
Detects the execution of rundll32.exe with a command line containing 'DavWWWRoot', indicating the loading of a DLL payload directly from a remote WebDAV share. This behavior is commonly associated with ClickFix/ClearFake infection chains where users are tricked into executing malicious payloads hosted on attacker-controlled WebDAV servers.
Detects the PIVOTPIPE .NET loader, which identifies and extracts a 'core.pak' file containing the RAT payload. The loader performs XOR-decoding and GZIP-decompression to reflectively load the malicious payload into memory using .NET reflection methods, bypassing traditional file-based execution.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects the BTR.sys driver, a tool identified as being extracted from Microsoft's MpEngine.dll and repurposed for kernel-level file and registry manipulation. The rule matches on specific SHA-256 file hashes or combinations of PE metadata strings, indicating the presence of this driver on the system.
Detects the execution of an installer file (.exe, .msi, .scr) located in common download or temporary directories that masquerades as a legitimate application (e.g., KeePass, Adobe Flash) or a medical document. The rule specifically identifies this behavior when it occurs within an hour of activity involving messaging applications like WhatsApp or Telegram, which is a known tactic in the 'CHOSEN BRICK' social engineering delivery chain.
Detects the loading of 'opencv_world4120.dll' by specific process names commonly associated with update activity (UpdateAssistant.exe, AppUpdateHelper.exe, SysMaintenance.exe) when the loaded DLL is either unsigned, untrusted, or has an invalid signature. This is indicative of potential DLL side-loading where malicious code is executed under the context of an ostensibly legitimate update process.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
Detects Vidar Infostealer variants by identifying its unique per-build polymorphic virtual machine bytecode interpreter and custom ARX stream cipher. The rule uses a combination of high file entropy, lack of standard OS cryptographic API imports, and the presence of structurally invariant indirect jump-table dispatch patterns used in custom VM execution loops.
This rule detects the execution of script files (such as .vbs, .vbe, .js, .jse) via wscript.exe when the file name uses a double-extension technique (e.g., .pdf.vbs) to masquerade as a benign PDF document. These files are typically found in temporary or user-download directories, indicating potential malicious activity initiated by downloaded attachments.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
Detects Android APK files utilizing anti-analysis techniques associated with the RatHat malware family, including malformed AndroidManifest.xml structures with custom 0x9999 chunk headers, high-entropy/oversized manifest files, and obfuscated DEX bytecode markers designed to disrupt static analysis and decompilation tools.
Page 23 of 80