Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects `cmd.exe` spawned by a Discord-enabled backdoor after command decoding rather than by an interactive user or administrative tool. The rule specifically looks for `cmd.exe` executing commands (`/c`) where the parent process is identified as `searchapp.exe`, `echocreep.exe`, `service.exe`, or `update.exe`.
GraphWorm Persists through a Run Key
Cortex XDR
Detects the creation or modification of a Windows Registry Run key that points to an executable with names associated with GraphWorm or C2OverOneDrive malware, or an unusual OneDrive-themed binary located outside of legitimate OneDrive client paths. This rule specifically looks for registry events where the key name contains 'CurrentVersion\Run' and the data contains 'C2OverOneDrive', 'GraphWorm', 'OneDrive.*AppData', or 'config.dat'.
Detects a specific C2 fallback mechanism used by Gamaredon, where the malware fails to resolve Cloudflare and then shifts to making multiple network connections to .ru or .su domains within a short time frame (more than 3 connections per minute). The connections are initiated by 'wscript.exe' or 'mshta.exe'. This pattern indicates a potential attempt to establish communication with a fallback command and control server.
Detects highly obfuscated VBScript execution utilizing specific array splitting and character decoding loops used by GammaDrop. The rule specifically looks for the combination of 'Split' and 'ChrW' functions within VBScript command execution, which is indicative of a common obfuscation technique used by the Gamaredon APT group.
Detects the iterative XOR decryption routine signature used to decode the Donut payload in memory prior to execution, specifically looking for large memory write operations initiated by 'setup.exe'.
Detects the creation of PwCWSP64.dll, a malicious network or Winsock Service Provider component dropped by Makop ransomware.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Identifies the creation of ransom notes or markers containing the victim ID bracket format used by Makop.
Detects a high volume of files being renamed to the .mkp extension within a 5-minute window, indicative of rapid Makop ransomware encryption.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects AutoHotkey scripts injecting into legitimate .NET binaries for defense evasion, specifically targeting processes associated with AsyncRAT. The rule looks for AutoHotkey.exe or command lines containing '.ahk' initiating processes that are known .NET binaries like AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe.
Detects the use of WMIC to create processes on remote nodes, a technique observed with the Gentlemen ransomware for propagation. This rule specifically looks for 'wmic.exe' executions with command-line arguments indicating remote node targeting and process creation.
This rule detects a specific kill chain involving PowerShell executing ClickFix, followed by rundll32 loading Matanbuchus, and finally, an AstarionRAT executable running from the AppData folder. The detection logic links these events by device ID and within specific timeframes (5 minutes between ClickFix and Matanbuchus, and 10 minutes between Matanbuchus and AstarionRAT).
Detects SimpleHelp executing PowerShell to download ransomware encryptor payloads (like LockBit or BlackCat) from external, untrusted infrastructure. This rule specifically looks for PowerShell commands using Invoke-WebRequest or Net.WebClient to download executable, DLL, or ZIP files, where the initiating process is 'JWrapper' (associated with SimpleHelp).
Identifies AstarionRAT establishing persistence by writing itself into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, specifically looking for an executable in an AppData path, initiated by rundll32.exe.
Identifies Havoc Demon payloads beaconing to anomalous, predictable HTTP/HTTPS URIs used by default Havoc profiles (e.g., /weather, /api/v1). The detection specifically looks for HTTP connections originating from processes located in the 'Downloads' folder.
Correlates the initial Fake Tech Support lure with the dropping of the secondary Havoc .exe or .dll payload into C:\Users\Public or %AppData%. This rule detects the creation of executable or DLL files in common public or user application data directories, specifically within 'C:\Users\Public' or 'C:\Users\<username>\AppData\Local', and correlates this file creation with a process that has '--kiosk' in its command line, which is often associated with browser-based lures.
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Detects the execution of 'filemanager.exe', a standalone credential stealer associated with the DeepLoad malware. This executable is designed to harvest browser passwords and is typically found running from user-specific application data directories such as AppData\Local, AppData\Roaming, or Temp.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
Page 117 of 232