Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,407
11,798
5,867
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule identifies instances where files with specific extensions (.dll, .py) or the python executable are created on a system shortly after (or exactly at) the observed creation timestamp of notepad.exe. This logic aims to detect potential masquerading or side-loading techniques where attackers may attempt to hide their activities or establish persistence by mimicking or piggybacking on standard utility usage.
YARA signature for the MSI installer's spoofed property data impersonating a legitimate Windows update package, requiring both the spoofed filename and an MSI-internal structural artifact
YARA signature for the msaRAT DLL requiring all embedded msaOpen/msaClose/msaError/msaMessage/dataAck binding names and Tokio/Rust runtime strings to co-occur in a valid PE/DLL
Detects binaries containing plaintext keyword trigger lists used by a keylogger module to target financial and cryptocurrency-related contexts (banking, wallets, payment services)
This rule monitors for the execution of a specific process file located within the 'ProgramData' directory that matches a known malicious MD5 hash.
Detects NirSoft-based credential harvesting toolkit binaries staged in user profile path csidl_profile\music\mimik\pass\, used to extract browser, VNC, email, Wi-Fi, and Credential Manager secrets
Detects known malicious files from the Stealth Falcon CURP/DlrtyGames delivery chain by SHA256 hash and by embedded reference to sideloaded/staged module filenames
Detects files associated with the DlrtyGames SFX dropper chain: DlrtyGames.exe dropper, Volt_Droid.exe signed host binary abused for DLL sideloading, and the trojanized discord-rpc.x64.dll dependency
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
Detects a native PE or ELF binary masquerading as JavaScript source (e.g. intro.js) dropped in node_modules
Detects execution/staging of the GodDamn ransomware encrypter binary encrypter-windows-gui-x86.exe from user profile Downloads or Music folders, or matching the known encrypter hash
Detects the execution of the NoEscape ransomware DISKWRITER component by matching known file hashes associated with the wiper malware.
This YARA rule detects specific ASP.NET web shells associated with the CL0P ransomware gang's exploitation of the MOVEit Transfer vulnerability (CVE-2023-34362). It identifies malicious activity by looking for custom HTTP headers ('X-siLock-') used by the exploit, specific hardcoded Azure storage interaction code snippets, and characteristic SQL injection queries targeting the application's user database.
This YARA rule detects files associated with the Agenda (Qilin) ransomware by searching for specific string patterns within the binary, such as hardcoded ransom note contents, Rust language artifacts, and an onion domain used for command-and-control or negotiation. It also validates the file as a Windows executable.
MAL AMOS yara x
YARA
This YARA rule detects the Amos Stealer malware on macOS by matching a specific Mach-O dylib hash and entitlement hash, which are consistent markers for samples of this information stealer.
This rule identifies a specific version of the Nmap executable by verifying the file's hash (MD5), the PE machine type, the linker version, and the existence of a specific section header. It is designed to confirm the integrity or identity of an authorized Nmap binary on Windows systems.
Detects known WinUpdateHelper.dll malicious variants by SHA256 hash, side-loaded to initiate infection across 17 kill chains
Detects macOS Mach-O binaries containing AES-GCM cipher references combined with /tmp staging paths, consistent with CrashStealer encrypting stolen data locally with AES-GCM before staging it in /tmp for exfiltration
Detects .NET binaries checking COR_PROFILER env var and IsDebuggerPresent, then calling FailFast to terminate under monitoring, as observed in the Stealth Falcon CURP/DlrtyGames stealer chain
Detects Inno Setup Installer executables carrying an appended/embedded payload overlay, consistent with the Inno Setup unpacking stage of the CURP campaign delivery chain
This YARA rule detects specific macOS malware components associated with the threat actor Citrine Sleet (AppleJeus) by matching static dylib and entitlement hashes. It targets identified malicious payloads including UpdateAgent, SimpleTea (POOLRAT), and CrashReporter to track the group's tooling.
Page 55 of 80