Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Detects the execution of 'filemanager.exe', a standalone credential stealer associated with the DeepLoad malware. This executable is designed to harvest browser passwords and is typically found running from user-specific application data directories such as AppData\Local, AppData\Roaming, or Temp.
Detects PowerShell reading and decompressing a disguised GZip stream named "Subtitles" which is often used to deliver further stage payloads, specifically associated with AsyncRAT.
This rule detects the execution of PowerShell, wscript, or cscript with command-line arguments containing "Invoke-WebRequest" or "curl" in conjunction with specific keywords like "guloader", "etherhiding", or "clickfix". This combination suggests an attempt to download or execute malicious payloads associated with these campaigns or malware families.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects suspicious command line arguments containing specific indicators related to darkcloud.
Detects notepad.exe making anomalous external network connections, which can be indicative of malware like PureHVNC or Brute Ratel C4 (BRc4) using a seemingly benign process for command and control or data exfiltration.
Detects the use of esxcli or vim-cmd commands on VMware ESXi hosts to power off virtual machines, remove software components (VIBs), or enable maintenance mode. These actions are commonly performed by the Akira ransomware group to disrupt operations and facilitate encryption.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
This rule detects when the Remcos RAT loader attempts to access browser cache folders (Chrome, Firefox, Opera). This activity is indicative of credential dumping, where the malware tries to extract sensitive information like stored passwords or session tokens from web browsers.
This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
This YARA rule detects the Nimplant malware, a lightweight C2 framework. It identifies Nimplant by looking for specific DLL and library names (some with common typos), a comprehensive list of Nim-related source file names often found in Nimplant builds, specific hexadecimal patterns corresponding to Windows API calls (like GetComputerNameW, CreateProcess, GetUserNameW, OpenProcessToken, CreateFileA, VirtualProtect, CreateToolhelp32, WinHttpConnect), Zlib compression patterns, TLS callback patterns, and various strings including registry keys and a version string for Nimplant itself. The rule aims to identify Nimplant executables or related artifacts on Windows systems.
Detects the loading of the 'wsftprm.sys' driver, which has been associated with CVE-2023-52271 and abused by ransomware groups to terminate security processes. This rule specifically looks for 'wsftprm.sys' in DeviceImageLoadEvents.
Detects the execution of a PowerShell script named 'nm.ps1', which has been associated with the Seedworm threat group for staging purposes. This rule specifically looks for 'nm.ps1' within process command lines.
This rule detects the creation or manipulation of mutexes by processes that contain keywords associated with the Remcos RAT (Remote Access Trojan). Specifically, it looks for command-line arguments containing "Remcos_Mutex_Inj", "Remcos_Mutex", "mutex", or "CreateMutex". This activity can indicate the presence or execution of Remcos RAT on a system, as mutexes are often used by malware for single-instance enforcement or inter-process communication.
Detects obfuscated JavaScript code indicative of STRRAT malware.
Page 118 of 232