Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
This rule detects the presence of known ShadowAgent malware files on devices by matching their SHA256 hashes. It queries 'DeviceFileEvents' to identify any files with SHA256 hashes that are part of a predefined list associated with ShadowAgent.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Detects AMOS malware forking a child process, using setsid to detach from the Terminal session, and then killing the Terminal window via killall Terminal to evade parent-process tracking. This is a key behavioral indicator of the Atomic macOS Stealer delivered via ClickFix campaigns.
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Detects anomalous outbound connections to Microsoft Teams TURN relays from non-Teams processes. This behavior can be indicative of malware, such as Backdoor.Turn, abusing legitimate Microsoft Teams infrastructure for command and control or data exfiltration, by masquerading malicious traffic as legitimate conferencing application traffic.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects process execution patterns associated with the Grandoreiro banking trojan, specifically the launching of browsers in kiosk mode for overlay attacks or the execution of suspicious non-UI binaries from scripts (wscript/cscript/mshta) located in user-writable directories.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
Detects execution patterns associated with the Grandoreiro banking trojan, specifically its overlay attack technique. The rule monitors for browsers launched in kiosk mode by unauthorized parent processes, the presence of Grandoreiro-specific banking identifier strings in process command lines, execution of unsigned binaries from AppData/Local that spawn browsers in kiosk mode, and the execution of specific known loader binaries spawned by script interpreters.
This rule detects the presence of known Android Remote Access Trojan (RAT) APK files on Windows endpoints, or the use of Android Debug Bridge (adb.exe) to install such APKs. It monitors file creation/modification events for specific malicious filenames and process execution patterns involving 'adb install' commands, as well as suspicious script interpreters creating APK files in user-writable directories.
Page 111 of 232