Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Detects the loading of .NET assemblies (mscorlib.dll, System.dll, System.Net.dll, System.IO.dll) by processes whose filenames start with 'GST' or contain 'Debit' or 'Invoice'. This pattern is indicative of the Remcos RAT loader attempting to execute without writing the assembly to disk, a technique often used to evade detection.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
Detects execution of the Prinz Eugen Go-based ransomware binary (servertool.exe) with the --delete flag, which instructs the encryptor to remove original plaintext files after encryption. The binary is known to execute from user-writable paths such as Music and OneDrive directories.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
This rule monitors for the execution of files or processes matching known file hashes associated with the APT28 (Fancy Bear/Strontium) threat group, specifically detecting SimpleLoader and various NotDoor components.
Detects the AMOS infostealer attempting to access and enumerate browser extension directories on macOS to harvest cryptocurrency wallet data from Chrome and Firefox profiles.
Detects potential information stealing activity, specifically the Atomic macOS Stealer (AMOS) malware, by monitoring unauthorized processes accessing Safari cookies and Apple Notes databases, excluding legitimate applications.
Detects network connection activity originating from a host to the hardcoded IP 62.102.148.212 on port 37393, which is identified as a command and control (C2) endpoint for Remcos RAT. This communication is often associated with process hollowing where the malware hides within legitimate browser processes.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects network scanning activity originating from processes side-loaded with Backdoor.Turn, specifically looking for 'dbgview64.exe' initiating connections to a large number of unique remote IPs.
Detects suspicious installation attempts of ManageEngine Endpoint Central (ADSelfService.exe) potentially associated with Prinz Eugen ransomware. The rule looks for silent installation parameters or execution initiated by PowerShell or Cmd.exe, which could indicate malicious deployment.
Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.
Detects suspicious installation attempts of ManageEngine Endpoint Central (ADSelfService.exe) potentially associated with Prinz Eugen ransomware. The rule looks for silent installation parameters or execution initiated by PowerShell or Cmd.exe, which could indicate malicious deployment.
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Page 113 of 232