Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,478
11,861
5,881
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
This rule detects the use of .NET deserialization gadgets, often associated with malware loaders like Remcos RAT, by monitoring process command lines for specific keywords such as 'ObjectInputStream', 'DeserializeObject', 'BinaryFormatter', or 'NetDataContractSerializer'. It further refines detection by looking for processes with file names starting with 'GST' or specifically 'Optimax.dll', which are indicators of the Remcos loader.
Detects file events related to potential Remcos RAT loader activity, specifically looking for files with names starting with 'GST' or containing 'GST_' and within a specific size range (1KB to 1000KB). This pattern is indicative of a known Remcos RAT loader.
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
Correlates PowerShell invoking the download of 7za.exe to extract the hidden payload out.7z. This rule specifically looks for instances where '7za.exe' is executed with 'out.7z' in its command line, and this execution is preceded by 'powershell.exe' with '7-zip.org' in its command line on the same device. This pattern is indicative of the UnregStealer malware's method of extracting its payload.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
This rule detects potential Prinz Eugen ransomware activity by identifying instances where drive letter enumeration commands (wmic.exe logicaldisk, fsutil.exe fsinfo, diskpart.exe) are executed, followed within 30 minutes by the execution of known ransomware executables (servertool.exe, encrypt.exe) on the same device. This sequence of events suggests reconnaissance prior to data encryption.
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.
Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.
Detects the execution of executable files (.exe) within a user's 'Music' folder, which is an unusual location for legitimate program execution. This activity is often associated with ransomware, such as Prinz Eugen, attempting to encrypt user files. The rule excludes executions initiated by common archive utilities (explorer.exe, winrar.exe, 7z.exe) to reduce false positives.
Detects fake AI installers (e.g., deepseek, ProFluxeFlowAi) making network connections before deploying a Python loader. This activity is indicative of social engineering campaigns leveraging popular AI brands to distribute malware.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects ClearFake PowerShell stager using 'iex' (Invoke-Expression) and 'irm' (Invoke-RestMethod) with '-UseBasicParsing'. This combination is often used by malware to download and execute scripts from the internet, bypassing more robust parsing mechanisms.
Page 119 of 232