Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects the creation of an executable file (.exe, .scr, .com, .pif) in user-writable directories (Temp, AppData, ProgramData) followed by the immediate execution of that same file. This is a common pattern for malware droppers where a file is dropped to disk and subsequently executed to initiate the next stage of an attack.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
This rule monitors for the creation of .exe or .msi files within common user-writable directories (Downloads, Temp, AppData) initiated by web browser processes (Chrome, Edge, Firefox, Brave). This behavior is often indicative of drive-by downloads or users interacting with malicious web content that delivers installers to the host.
Detects the execution of known OXLOADER malware samples from temporary directories or download locations. The detection focuses on identifying specific filenames and file paths, while the rule metadata highlights the malware's behavior of performing geofencing checks (e.g., CIS region evasion) using Windows API functions to determine the system's locale.
Detects the Montana Empire Android malware, either through a direct SHA256 hash match or through structural characteristics of the APK file (such as the presence of 'post.apk') combined with specific embedded strings commonly found in the attacker's fraudulent mobile landing pages used for social proof.
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Detects process creation of an executable named 'wusvc.exe' that originates from a user Downloads directory and is not digitally signed by Microsoft Corporation. This behavior is indicative of an adversary attempting to masquerade as the legitimate Windows Update service to evade detection.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Detects the creation of executable or script files within the Windows Startup folder where the parent process is WinRAR.exe. This activity is a common indicator of an adversary leveraging a self-extracting archive or malicious file extraction to achieve persistence by placing a payload in the user's startup directory.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
Detects a driver containing strings associated with the SprySocks malware, specifically related to Windows Filtering Platform (WFP) manipulation and the 'RawWNPF' string. The rule looks for the presence of 'RawWNPF', 'FwpmEngineOpen', 'FwpmFilterAdd', 'FwpmSubLayerAdd', and 'Delivery Optimization' within a file identified as a Windows executable (MZ header).
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Modular remote access trojan associated with long-term espionage intrusions
Infostealer distributed via fake open-source tool impersonation sites
Malvertising loader delivering CastleStealer via malicious Google Ads
USB worm and loader leveraging living-off-the-land binaries
Page 65 of 80