Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,425
11,812
5,870
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule performs an IOC sweep over the past 30 days using DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to detect indicators associated with PoeLLM / Canto Incognito malware campaigns, specifically scanning for known C2 IP addresses, Kryptex cryptomining pool endpoints/domains, and specific file hashes (SHA256).
This rule performs an IOC sweep over the past 30 days using DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to detect indicators associated with PoeLLM / Canto Incognito malware campaigns, specifically scanning for known C2 IP addresses, Kryptex cryptomining pool endpoints/domains, and specific file hashes (SHA256).
Detects the PoeLLM ELF payload (masquerading as libgcrypt) via Italian-language poem/agent log strings and embedded LiteLLM MCP exploit strings
This rule detects known-malicious activity associated with Warlock ransomware and the ToolShell malware campaign (linked to Storm-2603). It monitors for process, file, and image-load events matching identified malicious file hashes, as well as network connection attempts to known malicious domains and URLs. It also includes monitoring for traffic to 'oastify.com', a domain commonly used for Burp Collaborator, which requires correlation with other indicators to confirm malicious intent.
This rule detects known-malicious activity associated with Warlock ransomware and the ToolShell malware campaign (linked to Storm-2603). It monitors for process, file, and image-load events matching identified malicious file hashes, as well as network connection attempts to known malicious domains and URLs. It also includes monitoring for traffic to 'oastify.com', a domain commonly used for Burp Collaborator, which requires correlation with other indicators to confirm malicious intent.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
The following analytic detects the execution of native .NET binaries from non-standard directories within the Windows operating system.
It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
It leverages Endpoint Detection and Response (EDR) telemetry, comparing process names and original file names against a predefined lookup "is_net_windows_file".
This activity is significant because adversaries may move .NET binaries to unconventional paths to evade detection and execute malicious code.
If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Also this analytic leverages a sub-search to enhance performance. sub-searches have limitations on the amount of data they can return. Keep this in mind if you have an extensive list of ransomware note file names.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
This rule detects the presence of specific SHA-256 file hashes associated with the 'VPN for X' malicious proxy extension family, which are known to be used to transform systems into nodes within a proxy network.
Detects the GOST tunnel binary deployed as svchost.exe from a staging directory, identified by its known hash, or by an unsigned PE importing config.dll with a matching MZ header and embedded config.dll reference (reduces FPs from legitimately signed software that imports a DLL of the same name)
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the DragonForce TURN/MQTT campaign, as detailed in Lab52 threat research. It monitors for file and process activity matching known malicious hashes, as well as network connections to specific domains and URLs associated with the campaign's command-and-control infrastructure.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects the Akira ransomware binary staged as C:\storage\win.exe and identified by its known SHA256 hash
Page 3 of 80