Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects Sinobi Ransomware (suspected Lynx rebrand) payloads based on specific command-line arguments, help menu strings, ransom note URLs, and references to Curve-25519 and AES-128-CTR encryption routines.
Detects the Golang Sliver dropper or its associated opsec.log file. This malware leverages an LLM (GPT-4) to evaluate system telemetry before deploying its payload.
Detects the execution of 'SecurityHealthSetup.exe' from non-standard or suspicious directories such as 'Intel', 'Downloads', or 'Temp'. This executable is typically associated with Windows Security Health and should reside in system directories. Execution from other locations may indicate an attempt to masquerade malicious activity or defense evasion.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
Storm-2561 Malicious File Hash Detection
Cortex XDR
This rule detects the presence of malicious files associated with the Storm-2561 threat actor by matching their SHA-256 hashes. The rule specifically targets files on Windows operating systems and also filters for files signed by "Taiyuan Lihua Near Information Technology Co., Ltd.", which is known to be associated with these malicious activities. The detected files include ZIP archives, MSI installers, DLLs, and fake VPN executables.
Detects ELF binaries with suspicious capabilities for privilege escalation, such as shell execution and process capabilities
This rule detects artifacts associated with the APT36 CreepDropper malware, specifically focusing on scheduled task names and staging file markers. It looks for specific strings related to scheduled tasks like 'MicrosoftEdgesUpdatesTasksMachineUAs-Task' and 'MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy', as well as a staging file named 'ds.png' and other related strings such as 'msedge.exe', 'Task10', and 'System.Reflection.Assembly'. The rule requires at least four of these strings to be present, along with the MZ header, indicating a Windows executable.
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
Matches published CastleLoader stage hashes from ANY.RUN analysis.
Upx Packer
YARA
Generic detection for UPX packer
This KQL query identifies file creation events within common Windows startup directories and enriches them with Windows Shell Link (shortcut) creation activity.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Startup folders are frequently abused by adversaries for persistence since files or shortcuts placed here automatically execute at user login. The query covers both system-wide and user-specific startup paths and can exclude known legitimate items via an exclusion list to reduce false positives.
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects pkr_mtsi packer samples based on their characteristic use of junk GDI API calls for obfuscation. The rule looks for PE files that import an excessive number of GDI32.dll functions and contain repeated calls to CreateSolidBrush with random color values.
Detects PNG files containing a steganographic marker ('===') used by the GhostPoster malware campaign to hide a JavaScript payload. This technique was observed in malicious Firefox browser extensions.
Detects the MrAgent binary, a deployment tool used in RansomHouse operations to manage compromised ESXi hosts and deploy the 'Mario' encryptor.
Detects the ZEROLOT wiper, a component reportedly used by the Sandworm group. This rule identifies specific artifacts related to its disk wiping functionality.
Detects ScoringMathTea malware by identifying its custom in-line CRC32 table generation routine. This routine, used for integrity checks and anti-debugging, utilizes a unique polynomial constant (0x04C10DB7).
Page 73 of 80