Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,476
11,860
5,880
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the presence and execution of known FortiBleed malware components based on their filenames and SHA256 hashes. It monitors both process creation events and file events to identify the malware.
Detects cdg.exe receiving a temporary module path together with the first_match argument used by the campaign to decrypt and execute embedded shellcode. This behavior is indicative of the DAEMON Tools backdoor.
Detects the addition of broad exclusion paths to Microsoft Defender, specifically targeting drive roots, administrative shares, or common working directories. This activity is often associated with ransomware, such as the 'Gentlemen Ransomware', to evade detection.
This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
This rule detects potential Animateclipper malware or similar cryptocurrency clipboard hijackers by identifying the presence of Windows API calls related to clipboard manipulation (GetClipboardData, SetClipboardData) in conjunction with regular expressions for common cryptocurrency addresses (Bitcoin, Ethereum) and the keyword 'clipboard'. The rule triggers if at least three of these indicators are present, suggesting an attempt to monitor and replace cryptocurrency addresses copied to the clipboard.
Detects Python loading a .pyd or .so extension from common user-controlled directories like AppData, Temp, Downloads, or project directories, rather than from a trusted package installation. This behavior is indicative of the InvisibleFerret malware.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects process command lines containing strings associated with 'DarkCloud' malware, such as 'darkcloud', 'dark.cloud', 'cloud.dll', or 'shadow.exe'. This could indicate the execution or presence of the DarkCloud malware on a system.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
This rule detects internal HTTP PUT requests that contain the 'MZ' header, which is indicative of an executable file. This combination suggests a possible lateral movement scenario where an attacker is transferring a tool or malware within the internal network using HTTP PUT.
This rule detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. It identifies both successful connections and connection attempts.
This rule detects network communication associated with the 'easy-day-js Mastra npm Supply Chain' compromise. The first alert identifies C2 exfiltration attempts over TLS to a specific IP address (23.254.164.123) on port 443. The second alert identifies a stage-2 payload download from another specific IP address (23.254.164.92) on port 8000, specifically looking for the URI '/update/49890878'. These indicators are linked to the 'protocal.cjs' and 'setup.cjs' malware, respectively, and are part of a supply chain attack.
Detects suspicious process command lines associated with WebRTC, STUN, TURN, or ICE protocols when initiated by common web browsers (Chrome, Firefox, Opera) and having a parent process identified as 'Remcos'. This behavior could indicate the Remcos RAT attempting to establish peer-to-peer communication or exfiltrate data.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule aggregates these file events by device and time, triggering an alert if 10 or more such files are observed within an hour on a single device, indicating a bulk encryption event.
This rule detects suspicious execution of wscript.exe or cscript.exe that involves VBScript or VBE files and contains keywords commonly associated with financial documents or urgent notifications in the command line. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating phishing attempts or malware execution.
This rule detects multiple executions of VBScript or VBE files via wscript.exe or cscript.exe within a one-hour window, where the command line contains keywords commonly associated with malicious documents or phishing attempts (e.g., 'Invoice', 'Bill', 'Urgent', 'Payment'). This behavior can indicate user execution of a malicious script, often delivered via phishing.
Detects the creation of EtherRAT's hidden configuration file '.node_bot_id' within the AppData folder. This file is indicative of EtherRAT malware activity.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions from a single device within an hour is flagged, indicating potential malicious activity like phishing or malware delivery.
Detects the creation, modification, or renaming of files with the '.prinzeugen' extension, which is commonly associated with ransomware activity. The rule aggregates these events by device and time, alerting if 10 or more such files are observed within an hour, indicating potential widespread encryption.
Page 115 of 232