Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,476
11,860
5,880
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects artifacts and execution patterns associated with the Grandoreiro banking trojan. This includes the identification of known Embarcadero Delphi DLLs (mingwm10.dll, libwebp.dll, libffi-6.dll, libpng15.dll) being dropped into or loaded from AppData local directories, as well as wscript.exe or cscript.exe spawning suspicious executables from the same path, which is consistent with its VBS dropper chain.
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
Detects DLL side-loading activity associated with the Grandoreiro banking trojan. The rule identifies instances where legitimate, signed software (e.g., FastStone Image Viewer, MinGW, FreeMat, AbiWord) loads known malicious DLLs (e.g., mingwm10.dll, libwebp.dll) from user-writable directories such as %TEMP% or %APPDATA%, which is a characteristic behavior of the malware.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
This rule detects the creation of 'pythonw.exe' within a user's AppData\Local folder. This is a suspicious activity, especially when the file lacks a valid digital signature, as it could indicate the dropping of malicious Python interpreters or scripts by threat actors. The rule specifically looks for the file name and folder path, with an implicit check for the absence of a digital signature (which would require a 'FileProfile' join in a production environment).
Detects the execution of the Go-compiled Gentlemen ransomware payload from unusual directories, exhibiting self-propagation mechanisms. This rule specifically looks for executables with a generic name pattern (e.g., 'abc.exe') in common temporary or shared directories (Temp, Downloads, Public, ProgramData) and command-line arguments indicative of propagation, scanning, or encryption activities.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects unauthorized processes monitoring the system clipboard and replacing content with cryptocurrency addresses. This behavior is indicative of clipboard hijacker malware or banking trojans (such as Rokarolla) attempting to redirect funds by modifying the address in the clipboard.
Detects a web process modifying a .php file within WooCommerce paths, immediately followed by a DNS resolution for the 'generate.2faplugin.org' domain. This activity is indicative of the ShapedPlugin supply chain compromise where backdoored plugins are distributed, leading to file modification and subsequent communication with a malicious 2FA plugin domain.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects the high-tempo Medusa ransomware encryption phase by identifying a large number of file renaming operations that append the '.medusa' extension within a short timeframe (1 minute). This rule specifically looks for more than 50 such rename events per device per minute.
Detects a process rapidly accessing multiple target credential stores (Login Data, Cookies, Web Data, places.sqlite) within a short time frame (1 minute). This behavior is indicative of credential stealer malware like Vidar attempting to exfiltrate sensitive browser data.
Detects unauthorized processes monitoring the system clipboard and replacing content with cryptocurrency addresses. This behavior is indicative of clipboard hijacker malware or banking trojans (such as Rokarolla) attempting to redirect funds by modifying the address in the clipboard.
Detects the execution or file creation of identified Turla STOCKSTAY malware components, specifically targeting a list of known malicious filenames and installers used by this actor.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Detects AutoHotkey (AHK) scripts spawning specific .NET Framework processes (cvtres.exe, AddInProcess32.exe, AppLaunch.exe, aspnet_compiler.exe), which is indicative of process hollowing, often used by malware like AsyncRAT to inject malicious code into suspended legitimate processes.
Hunts for the Python process utilizing ctypes bindings to dynamically resolve VirtualProtect and patch the AmsiScanBuffer. This rule specifically looks for 'WriteProcessMemoryApiCall' events where the initiating process is 'python.exe' and the target memory address is within the 'amsi.dll' module.
Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.
Detects when a ScreenConnect installer or related process loads the 'vcredist_x64.dll' file from a temporary, downloads, or AppData folder. This behavior can indicate DLL side-loading, where a malicious DLL is placed in a location that a legitimate application will search before its intended, trusted location, potentially for privilege escalation or persistence.
Generic detection for MSI-based installer droppers
Detects Vidar Stealer performing classic APC injection into a browser process (Chrome/Edge/Brave) using CreateRemoteThread with NtTestAlert as the thread start address and NtQueueApcThread to queue CryptUnprotectMemory for in-memory ABE v20_master_key decryption.
Page 112 of 232