Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,476
11,860
5,880
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the loading of DLLs named 'Optimax.dll' or 'System Optimizer Ultimate.dll', which are associated with potentially unwanted programs (PUPs) or malicious software. The rule also identifies a specific malicious hash for 'Optimax.dll'.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects Vidar Stealer's technique of bypassing Chrome's Application-Bound Encryption by spawning a suspended Chrome instance with specific command-line flags for APC-based CryptUnprotectMemory injection, combined with accessing Chrome credential files (Login Data, Cookies, Local State) for cookie and password theft. This rule correlates process creation events of Chrome with suspicious command-line arguments and file access events to Chrome's credential stores by the same initiating process within a short time frame.
Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.
Detects activity associated with VAPT (Vulnerability Assessment and Penetration Testing) frameworks, specifically looking for marker strings in process command lines and known VAPT malware names in file and process events. This rule aims to identify potential privilege escalation attempts or the presence of VAPT tools on a system.
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
Detects activity associated with Operation Poisson credential theft, specifically the use of VBScript (sys.vbs) to launch a Python keylogger (pynput or keyboard library) or the installation of keylogger dependencies via pip. It also includes a hash match for a known artifact (KeyL.zip).
Detects the loading of specific DLLs (7z.dll, normaliz.dll) from user-writable directories like AppData, Temp, Roaming, or Local, excluding legitimate installations of 7-Zip or Windows system directories. This behavior can indicate DLL sideloading or other forms of malicious code execution where an attacker places a malicious DLL in a location that a legitimate application will load.
Detects file creation or process execution occurring from a folder named 'GentlemenCollection', the known staging directory for Gentlemen RaaS EDR killers prior to ransomware encryption.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
Detects unusual DLL loads associated with the VirtualBox DbgView64.exe process, potentially indicating the DLL sideloading technique used to inject the Backdoor.Turn RAT.
Detects the malware reading seemingly benign .bmp files from disk, which actually contain the steganographically encoded secondary payload. This rule specifically looks for a process accessing a .bmp file and then loading an image from the 'C:\Users\Public' folder, indicating a potential steganographic attack where a malicious payload is hidden within a benign image file.
Detects a spoofed utility executable (like CrystalDiskInfo via MSI) loading the malicious autorun.dll from the downloads path, indicative of a cryptojacking campaign.
Identifies RuntimeHost.exe spawning legitimate Microsoft .NET binaries (InstallUtil.exe) in a suspended state (no arguments) to hollow and inject miner shellcode.
Identifies anomalous executables running directly from the Steam workshop/content/431960 folder, excluding legitimate wallpaper executables. This folder is known to be abused by adversaries to distribute malicious software disguised as Steam Wallpaper Engine content.
Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.
This rule detects suspicious execution patterns involving 'wscript.exe' or 'cscript.exe' that utilize common COM objects or VBScript, while excluding executions from standard Windows and Program Files directories. It specifically looks for multiple unique command line executions within a two-hour window from the same device and account, indicating potential malicious script activity.
Detects rapid sequential file rename/write operations across multiple directories within a short window, which is a behavioral signature of active ransomware encryption activity. The rule specifically looks for more than 200 file operations (renamed or created) with a file extension matching a 4-8 character alphanumeric pattern, across more than 5 unique folders, all occurring within a 2-minute window and completing within 120 seconds.
Detects a .zip or .rar archive being dropped in a downloads folder, followed immediately (within 10 minutes) by the execution of a suspicious installer executable from that same path. The installer executable names are indicative of fake AI-related software (e.g., deepseek, gpt, kimi). This pattern suggests a social engineering attack where users are tricked into downloading and executing malicious software disguised as legitimate AI applications.
This rule detects the presence and execution of known FortiBleed malware components based on their filenames and SHA256 hashes. It monitors both process creation events and file events to identify the malware.
Page 114 of 232