Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
This rule identifies known malicious components associated with TriBack Loader by monitoring for exact cryptographic MD5 hash matches of three specific DLL files: hostfxr.dll, avk.dll, and MpClient.dll. By using exact hash matching, the rule minimizes the risk of false positives that might arise from filename-based detection of legitimate system binaries.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
Detects the lateral movement behavior of the TOKYOCORE ransomware, which involves copying the 'fsociety.exe' file to remote hosts using administrative shares (ADMIN$ or IPC$) or specifically targeting the '\Windows\Temp\' directory.
Detects the execution or presence of the TOKYOCORE ransomware binary by matching its known MD5 and SHA256 file hashes, or by identifying the specific filename 'fsociety.exe'.
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.
Detects TOKYOCORE ransomware via high-confidence identity strings; a single match is sufficient
Detects the ClickFix execution chain: base64-encoded regsvr32 command pasted into the Windows Run dialog, staging TinyEgg as an OCX payload.
Detects the dropping of the NoEscape ransomware DISKWRITER binary, masquerading as 'winnt32.exe' within the C:\Windows\SysWOW64\ directory. This is identified by the specific file path and hash associated with the known malware threat.
Detects Mach-O ARM64 payloads disguised as legitimate macOS system utilities (CamDriverUpdate.app camera driver updater, Chrome.MediaPatcher) used in the BlueNoroff ClickFix campaign
Detects PE files exhibiting combined structural anomalies consistent with Dolphin X's opt-in mutation engine tiers: altered PE compile timestamp, rewritten section padding (raw size vastly exceeding virtual size), and per-build re-encrypted embedded strings surfacing as high-entropy sections
Project CAV3RN
Cortex XDR
This rule monitors for indicators of compromise (IOCs) associated with a specific malicious activity or campaign, designated as 'Project CAV3RN'. It flags network communication with known malicious domains and IP addresses, as well as the execution or presence of specific file hashes and filenames (e.g., AzureCommunication.dll, logAzure.txt, NewProject.dll) related to the threat.
Detects PE files from the TAG-195 TinyEgg/ChonkyChicken/ChromEggscalator MaaS family via co-occurrence of distinctive embedded command markers, debug flags, and log path strings, requiring at least two markers to reduce false positives from individually generic strings
Exact SHA256 match against the two known malicious mrmustard 0.7.4 PyPI sdist/wheel artifacts. Uses full-file (0, filesize) SHA256 equality only, not partial or truncated comparison.
Detects PE files identified as SourTrade payloads by identifying the presence of a '.bun' section, an embedded 'app.js' string indicative of JavaScriptCore usage, and a high-entropy data block within the '.bun' section, distinguishing malicious payloads from legitimate Bun-compiled binaries.
Detects TOKYOCORE via overlap of data-theft artifact strings and persistence-mechanism strings (Tier 4 cluster)
Tier 5 catch-all: flags files exhibiting a broad spread of TOKYOCORE-related strings across identity, C2, ransom-note/branding, destructive, file-operation, data-theft, and persistence clusters, regardless of which specific cluster dominates
Detects AzureCommunication.dll C2 communication module by embedded strings or known hashes
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
Page 54 of 80