Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,476
11,860
5,880
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential ransomware activity by identifying rapid bulk file modifications or renames that result in files adopting extensions commonly associated with ransomware encryption. It looks for a high volume of file events (creation, modification, rename) within a short timeframe (1 hour) where the new file extensions match a predefined list of ransomware-specific extensions.
Detects DC-RAT by matching complete static API/function and string fingerprint.
This rule detects suspicious execution of rundll32.exe by the Tomb crypter, which is known to unpack and execute malicious DLLs. The detection logic specifically looks for rundll32.exe processes where the command line ends with ",rundll" and the executable is located in common temporary or public user directories such as AppData\Local\Temp, ProgramData, or Users\Public. This pattern is indicative of the Interlock/Rhysida ransomware ecosystem.
Detects potentially unwanted programs (PUPs) establishing reboot persistence by writing their extracted, secondary malware stage into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for registry modifications where the value data points to an executable within AppData (Local or Roaming) and the initiating process is an installer, updater, or setup executable.
Detects the execution of newly seen binaries containing valid Digital Signatures from issuers identified in Fox Tempest's malware signing service. This rule specifically looks for process creation events where the binary has a valid digital signature and a global prevalence of less than 50, and then joins these events with network connection events from the same device, indicating execution and beaconing activity.
Detects the usage of Fox Tempest certificates to sign and load malicious .sys drivers into the Windows kernel space to blind EDR. The rule specifically looks for signed .sys files being loaded from temporary or downloads folders.
Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.
Detects the widespread creation of the specific !readme_medusa!.txt ransom note or its HTML variant across directories, indicating a Medusa ransomware operation.
Detects the execution of the primary Rust-based payload named 'Подтверждение заказа продукции ЦАИ.exe' extracted from the ZIP archive, associated with the Silent Rotor campaign.
Detects the loading of suspicious DLLs and support files (e.g., systemsettings.dll, dsccorer.mui, syncres.dat, msedge.dll) from atypical AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates these file loads with known MD5 hashes associated with Sharkloader, indicating potential malicious payload execution or side-loading activities.
This rule detects potentially malicious Android applications masquerading as security updates that request 'Device Administrator' permissions. Such apps often attempt to gain elevated privileges to maintain persistence, prevent uninstallation, or perform unauthorized administrative actions on the device.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects the SNOWLIGHT dropper creating a malicious Windows Service masquerading as the legitimate 'Windows Update Service' (wusvc), followed by outbound TLS network connections to non-Microsoft infrastructure within a 2-minute window. This behavior is indicative of C2 communication from a compromised system.
Detects the modification of the 'LegalNoticeText' registry value to display Pay2Key ransomware-related strings. This activity is indicative of a system being targeted or compromised by the Pay2Key ransomware, which uses this registry key to display a ransom message upon user logon.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders.
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
Identifies network communication initiated by Microsoft Word (WINWORD.EXE) to Discord webhooks, which could indicate an attempt to exfiltrate stolen information, such as One-Time Passwords (OTPs), often associated with phishing campaigns.
This rule detects outbound network requests to the Filemail API (specifically '2117.filemail.com/api/file/get') followed by the dropping of a ZIP archive within a 10-minute window by the same initiating process on the same device. This behavior is indicative of the 'Screening Serpens' threat activity, where adversaries use legitimate web services like Filemail to deliver malicious payloads.
This rule detects the execution of processes containing the string "zuidrt" or the execution of 'mshta.exe', followed by a network connection to the known XenoRAT C2 IP address 185.235.137.106. This correlation aims to identify XenoRAT payload execution and subsequent communication with its command and control server, as observed in Operation XENOFISCAL.
Detects DNS lookups targeting the .xyz TLD indicative of Potemkin DGA behavior, specifically when initiated by 'RunSearch.exe'. The regex identifies domain names with a pattern of 2 or 3 hyphen-separated alphanumeric strings, followed by the .xyz TLD.
Page 116 of 232