Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
Detects the creation or execution of specific file artifacts associated with the ClickFix RAT that disguise Python executables or bytecode as standard image files to evade detection. The rule specifically looks for file names 'mev.png', 'uso.ico', or 'uso.png' in file or process events.
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
Detects the Miasma/Hades langchain-core-mcp malicious Python startup-hook loader
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
Detects the execution of binaries hidden in the C:\ProgramData directory with a .log extension matching a specific random pattern used by threat actors. This technique is often used for defense evasion and masquerading.
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
This rule detects when an executable (.exe) is launched from the AppData\Roaming directory. This directory is often used by legitimate applications, but it is also a common location for malware to drop and execute itself. The rule excludes processes related to OneDrive and Teams to reduce false positives.
This rule detects the execution or writing of a file with a specific SHA256 hash associated with the 'GateKeeper' payload. It monitors process creation events, new executable writes, PE file writes, and image loads on Windows platforms to identify the presence and activity of this known malicious file.
Detects Code Integrity (CI) engine blocking processes from loading unsigned DLLs residing in suspicious locations
Detects an appx package deployment that was blocked by AppLocker policy.
Triggers on any Sysmon "FileBlockExecutable" event, which indicates a violation of the configured block policy
Detects execution of AppX packages with known suspicious or malicious signature
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
Detects malicious DLLs masquerading as libcurl.dll by identifying a low number of curl_easy_* exports combined with BRUSHLOGGER keylogger string artifacts. Designed to catch DLL side-loading attempts.
Page 72 of 80