Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule detects the creation of executable or script files within common user-writable directories (Downloads, Desktop, Documents, Temp) when the file writer process is identified as '7z.exe'. This behavior is common in download-and-execute attack chains where an archive is extracted to place malicious payloads on the system.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects when common archiving utilities (WinRAR, 7-Zip) write a .lnk file to the Windows Startup folder. This behavior is indicative of an attacker attempting to establish persistence by creating a startup link to a payload via an archiving tool.
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Generic detection for MSI-based installer droppers
This rule detects a suspicious sequence of file creation events occurring within a 60-second window in a temporary directory. The pattern involves the creation of a .lnk file, a .pdf file, and an executable (.exe or .dll). This behavior is characteristic of malicious activity where a shortcut file is used to lure a user into opening a document that subsequently executes a malicious payload.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
This rule detects processes that load sensitive Windows multimedia and graphics modules (mmdevapi.dll, avrt.dll, magnification.dll, dxgi.dll) which are commonly utilized for audio recording and screen capturing. The rule filters out known legitimate applications (e.g., Teams, Zoom, Web browsers) and trusted software publishers. It further identifies potential suspicious activity by flagging processes originating from common staging paths like 'Temp', 'Downloads', or 'ProgramData' and instances where the process image is unsigned.
This YARA rule detects a specific PDB (Program Database) path associated with the SessionGate 7ZipDownloader malware. The presence of this string in a file indicates that the file is likely a component of the SessionGate malware, specifically its 7ZipDownloader module. PDB paths are often left in compiled binaries and can serve as unique indicators for specific malware families or development environments.
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
Detects evidence of the SNOWLIGHT dropper establishing persistence by registering malicious services (e.g., 'wusvc', 'RageService') or executing known malicious binaries (e.g., 'wusvc.exe', 'win_guard_0.exe') via service creation utilities or registry modifications.
Page 70 of 80