Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the presence of the modular C# backdoor framework known as Stella_Gary, used by the Kimsuky (APT-C-55) threat group. The rule identifies specific namespace and class strings associated with the framework within .NET executable files.
Detects Windows PE files exhibiting characteristics of BabylonRAT, specifically the use of dynamic API resolution via GetProcAddress and LoadLibrary to hide imports, combined with XOR-obfuscated strings for sensitive functions like CreateProcess, WriteFile, and InternetOpen to evade static analysis.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
This rule detects the presence of the unsigned 'OrionQuests-Setup.exe' file, which is a deceptive .NET installer associated with the Kimsuky (APT-C-55) threat actor, used to distribute the Stella_Gary backdoor. The rule looks for specific strings associated with .NET binaries and shortcut (LNK) file interaction, while excluding signed executables to reduce noise.
Detects Koktevrat Android RAT APK artifacts via obfuscated component class names (JyfNnJyj, GtVyayDo) and the Stage 2 package identifier com.kowo.ciligeci
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects Koktevrat Stage 1 dropper (femam.apk / MandatGO) that decrypts and installs the encrypted wudEMR.apk secondary payload using a 3-byte XOR key
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
This rule detects the presence or execution of a file named 'GlobalProtect.exe' within the Palo Alto GlobalProtect directory. It focuses on identifying potentially masqueraded or unauthorized binaries by monitoring file events and associated process execution. This pattern is commonly used by attackers to disguise malicious files as legitimate security software to evade detection.
This rule monitors for network connections to known command-and-control (C2) IP addresses and the execution or presence of files matching known hashes associated with the 'PhantomC2' threat group or malware family. It correlates data from DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to identify potential compromise.
Matches known Phantom Stealer MaaS infostealer sample hashes
This rule monitors Portable Executable (PE) files to identify those signed with certificates associated with Discord Inc. or Lenovo. Adversaries frequently abuse stolen or fraudulently obtained code-signing certificates from legitimate, reputable companies to bypass security controls like Windows SmartScreen, gain persistence, or increase the likelihood of successful malware execution.
This rule monitors Portable Executable (PE) files to identify those signed with certificates associated with Discord Inc. or Lenovo. Adversaries frequently abuse stolen or fraudulently obtained code-signing certificates from legitimate, reputable companies to bypass security controls like Windows SmartScreen, gain persistence, or increase the likelihood of successful malware execution.
Matches known SilverFox malware payload samples by SHA256 hash
Detects the presence of the Docro Hijacker browser hijacker component (Adblock.dll) designed to tamper with Chrome's 'Secure Preferences' file. It specifically looks for indicators of HMAC-SHA256 integrity check bypass mechanisms used to force-install malicious browser extensions.
Detects NSIS installer/archive contents bundling the specific unsigned/renamed UpdateAssistant.exe (aka AppUpdateHelper.exe) payload alongside its associated staged runtime DLLs and known malicious file paths/hashes used as cover noise for DLL sideloading staging
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
Detects the invocation of the AppInstaller executable to install .msix packages, often used in software installation or malicious delivery scenarios involving application deployment.
Detects the Warden.dll companion DLL shipped as part of the ShieldCrash (CVE-2026-69414) exploit chain, tightened to require an unsigned/unknown publisher or a suspicious install path alongside the generic filename
This rule detects potential phishing activity by correlating email delivery of Excel attachments with subsequent network connections to known malicious domains initiated by common browser or office processes. It identifies cases where a user may have opened a suspicious Excel file and initiated an outbound network request to a flagged domain within 24 hours of receiving the email.
Page 43 of 80