Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule detects the execution of unsigned or invalidly signed executable files from user-writable folders such as \Users\ or \ProgramData\. It specifically looks for process creation events where the initiating process's signature status is not 'Valid' and the SHA256 hash of the executable is not in a predefined whitelist. Additionally, it filters for executables with a global prevalence of less than 2500 and an unsigned signature state. This aims to identify potentially malicious or unauthorized software being run from locations where users typically have write permissions, bypassing standard software deployment and security controls.
This query identifies single character file names used at point of execution or in command line arguments with optional logic to look for the file creations.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the spyware components.
Detects the LANDFALL Android spyware components, specifically the 'b.so' loader and the 'l.so' SELinux policy manipulator.
Detects malformed DNG/TIFF image files containing an embedded ZIP archive, a technique used to deliver the LANDFALL Android spyware.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
Detects Airstalk malware, which exists in both PowerShell and .NET variants. The rule identifies specific strings related to its C2 communication over the AirWatch MDM API, tasking, and other unique artifacts.
Yara rule that detects EggStremeFuel backdoor.
This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.
This rule detects Portable Executable (PE) files that masquerade as PDF documents by embedding specific PDF-themed icons. The rule checks for the standard PE file magic bytes and then hashes the first resource (typically the icon) of the PE file. If the hash matches any of the known hashes for PDF red icons, it triggers an alert. This technique is commonly used by attackers to trick users into executing malicious files that appear to be benign PDF documents.
Detects PhantomVAI Loader and its common payload, Katz Stealer. PhantomVAI is a .NET loader known for delivering various infostealers and uses VM detection techniques. Katz Stealer is an infostealer notable for its anti-CIS country checks to evade analysis.
Detects HTML phishing pages created by the 'IUAM ClickFix Generator'. These pages mimic browser verification challenges to trick users into executing malicious PowerShell or Bash commands to deliver infostealers like DeerStealer and Odyssey.
Detects components of the NET-STAR malware suite, including IIServerCore and AssemblyExecuter, used by the Chinese-nexus APT group Phantom Taurus.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
Yara rule that detects BPFDoor backdoor.
Yara rule that detects Veaty backdoor.
Detects LESLIELOADER, a Go-based malware loader used by the Chinese state-sponsored group RedNovember (TAG-100, Storm-2077) to deliver payloads such as SparkRAT and Cobalt Strike.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects the managed .NET IIS module variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Page 74 of 80