Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,413
11,804
5,869
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the presence of Toy Ghouls' mqtt-bird-agent or matrix-bird-agent backdoor binaries. These binaries are identified by specific filenames, the inclusion of ChaCha20-Poly1305 cryptographic indicators, and operations involving the Windows MachineGuid registry key used to seal configuration files.
This rule detects the presence of files known to be part of the SynkLoader malware delivery chain by matching their SHA256 hashes. It specifically identifies a malicious MSI installer, a Python-based loader (ss.py), and a fake msvcp150.dll runtime file used for DLL side-loading.
Detects network activity initiated by the QUICAgent backdoor (Windowsupdate.exe), which is utilized for file exfiltration and payload delivery. The detection is triggered by identifying the specific file name 'Windowsupdate.exe' in conjunction with the known malicious SHA-256 hash associated with this backdoor.
Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.
Detects the presence of known StyleSmuggler implant binaries (noted as Rust-based implants masquerading as gvfsd-user or kworker) by matching file SHA256 hashes.
Detects the presence of the StyleSmuggler Rust-based Linux implant. The rule identifies the malicious binary by its static SHA256 hashes or a combination of indicators including masquerading as a kernel thread, utilization of gvfsd-related filenames and directories, and interaction with Redis session data.
Detects the execution of Windowsupdate.exe, a known component of the QUICSILVER campaign. The backdoor is identified by its filename and specific file hash. Once executed, it facilitates system and directory discovery, including hostname enumeration and file system navigation.
Detects Toy Ghouls backdoor binaries (cplsupport.exe and wtass.exe) via known MD5 hashes or the presence of these files alongside a config.toml configuration file.
Detects the execution of an unsigned binary named '.macos' located within a 'Contents/MacOS/' directory structure, which is a common pattern for malicious applications attempting to masquerade or hide their execution profile on macOS.
This rule detects the presence of XMRig cryptocurrency mining binaries, including those associated with the MayaBot campaign, by inspecting file contents for characteristic strings, configuration parameters, and executable signatures.
Detects the loading of 'SolidPDFCreator.dll' from a specific 'C:\ProgramData\IDM\logs\' directory by specific executables often associated with potential malicious activity or masquerading. This behavior is indicative of potential DLL side-loading or execution of masqueraded binaries.
Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events
Detects the execution of the PhishLocker module, a component of the SynkLoader malware. This module is designed to display a fake, full-screen Windows lock-screen overlay to conduct credential phishing. The rule identifies processes exhibiting the 'Main Window' title associated with these malicious DLLs (msvcp150.dll or msvcp160.dll) that are typically used for sideloading.
Detects a malicious DLL component associated with SynkLoader, identified by specific exported functions (RunPowerShell, ExecutePowerShellCommand) and assembly metadata that facilitate executing PowerShell commands directly in memory.
Detects the execution of a Faronics Deploy installer that has been renamed to mimic Adobe-related software. This technique is often used in phishing campaigns to trick users into executing binaries that lead to the silent installation of remote monitoring tools like ScreenConnect.
Detects the presence of known malicious files associated with the Dark Caracal LATAM campaign, including GoCaracal, Bandook RAT, and Delphi-loader payloads, based on specific SHA-256 file hashes.
Detects malicious DLL files attempting to masquerade as legitimate Microsoft Visual C++ runtime libraries (msvcp150.dll or msvcp160.dll) by identifying export markers and internal strings associated with the SynkLoader reflective PE loader.
Detects execution of a specific msaRAT MSI custom action that loads an embedded lib.dll payload from the MSI Binary table into memory via msiexec.exe during the InstallFinalize phase.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
Detects a universal (fat) Mach-O binary containing both x86_64 and arm64 architecture slices, within a specific file size range (500KB to 20MB). This signature matches the final-stage payload observed in the fake OpenAI Codex ClickFix campaign associated with the Atomic macOS Stealer (AMOS) malware.
Detects malicious PDF attachments that masquerade as DocuSign remittance advice notifications. These PDFs contain embedded hyperlinks (via /URI or /Link action annotations) designed to redirect users to malicious external sites rather than legitimate DocuSign services, commonly used in phishing campaigns.
Page 51 of 80