Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects scenarios where 7-Zip (7z.exe or 7zG.exe) extracts an executable file to a user-writable directory (such as Downloads, Temp, or AppData), potentially stripping the Mark-of-the-Web (MOTW) identifier. The rule specifically tracks instances where such an extracted file is subsequently launched by the shell or Windows explorer within 5 minutes of extraction.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
This YARA rule detects the Nimplant malware, a lightweight C2 framework. It identifies Nimplant by looking for specific DLL and library names (some with common typos), a comprehensive list of Nim-related source file names often found in Nimplant builds, specific hexadecimal patterns corresponding to Windows API calls (like GetComputerNameW, CreateProcess, GetUserNameW, OpenProcessToken, CreateFileA, VirtualProtect, CreateToolhelp32, WinHttpConnect), Zlib compression patterns, TLS callback patterns, and various strings including registry keys and a version string for Nimplant itself. The rule aims to identify Nimplant executables or related artifacts on Windows systems.
Detects execution of the process 'PerfWatson2.exe' (associated with TinyRCT malware) from file paths other than the expected %LOCALAPPDATA% directory.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects the presence of Windows Media Player or Mixed Reality process executions in conjunction with the creation of a specifically named DLL (nvdaHelperRemote.dll) within the Windows Media Player directory, which is a common indicator of DLL side-loading or hijacking techniques targeting these applications.
Detects unsigned or non-Microsoft signed executables running from the Windows Media Player installation directory. This behavior is indicative of masquerading techniques used by attackers, such as the Operation DragonReturn campaign, to hide malicious services or components within trusted system directories.
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
This rule detects the execution of a specific Chinese-named payload, '_計畫申請審查結果通知單.exe', which is associated with the Dragon Weave campaign and the AZUREVEIL attack flow. It also correlates this process execution with the presence of 'BrowserViewUtility.exe' as an initiating process file event, indicating a multi-stage infection.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
Detects a malicious executable imitating the .NET Runtime Optimization Service when found in the ProgramData folder. This is a common technique used by adversaries to masquerade malicious processes as legitimate system components.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Page 71 of 80