Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule detects the presence of the GodDamn ransomware encryptor on a host by identifying the specific binary filename (encrypter-windows-gui-x86.exe), its known SHA256 hash, or the presence of the .God8Damn file extension commonly associated with files encrypted by this malware.
Detects the execution of rundll32.exe with specific suspicious DLLs (drx_curator.dll, etwhost.dll) and specific function names or paths. This pattern is indicative of potential malicious activity where legitimate binaries are leveraged to execute code, often associated with modular loaders or malicious payloads.
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
This YARA rule detects the SugarWraith loader, a malware component identified by the presence of specific diagnostic strings, system enumeration artifacts, and indicators of persistence or configuration related to tunnel bypass tools like ngrok. It specifically targets Windows-based binaries that exhibit characteristics associated with the UNK_SweetSpector threat activity.
ROOT SUTERUSU
YARA
This YARA rule detects the presence of Suterusu rootkit source code artifacts, specifically targeting header files, function names, and print strings used for rootkit operations such as process/file/port hiding and module loading manipulation.
Detects a malicious binary masquerading as a Symantec executable (symantec.exe) staged in the user's Music directory. The rule triggers on a known file hash or the combination of the specific filename and file path, indicative of a dropper attempting to install the PoisonX kernel driver.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detects the execution of specific suspicious filenames ('YEPlayer.exe', 'Pis2rayVPN.msi', 'YEMPlayer.msi') or command-line references to these files, combined with correlated network activity to specific suspicious domains associated with masqueraded 'microsoft.comi-site.website' URLs.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
day3 ProgLangs
YARA
These YARA rules detect the presence of compiled executables written in Rust, Golang, or Nim by matching specific language-related artifacts, such as compiler-generated metadata, runtime library paths, or symbol patterns within Windows PE or Linux ELF binaries.
day2 FakePDF PE
YARA
This YARA rule detects malicious PE executable files that masquerade as PDF documents by embedding known PDF-related icons within their resource section. It inspects the PE file header and calculates the SHA256 hash of the first resource, matching it against a list of hashes corresponding to legitimate PDF icons.
Matches known Umbrij ConfuserEx-obfuscated .NET malicious DLL samples across three tool versions by full-file MD5 hash
Detects the creation or presence of a file named 'svehost.exe' (a common typo-squat for 'svchost.exe') within the 'C:\Users\Public\AppData\Windows' directory. This behavior is indicative of an adversary attempting to masquerade a malicious executable by mimicking a legitimate Windows service process name and placing it in a non-standard, often-abused location.
Detects the creation or modification of Windows Registry Run/RunOnce keys that point to executable files located in suspicious directories, specifically 'AppData' or 'Temp'. This behavior is a common persistence technique used by malware and adversaries to ensure malicious binaries execute upon user logon.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
This rule monitors for the execution of known software utilities often used by adversaries to disable security controls, remove system locks on files, or tamper with security configurations. Specifically, it flags the usage of IObit Unlocker, Gmer (a known rootkit/tampering tool), and Defender Control (used to disable Windows Defender).
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
Page 56 of 80