Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Identifies PowerShell dynamically decompressing a payload disguised as a file named 'Subtitles', which is a known technique used by AsyncRAT.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
Detects PowerShell constructing an AES object in CBC mode and decrypting bytes before dynamic script execution, indicative of malware like Banana RAT.
Detects rundll32 loading a DLL from common user-writable directories (Downloads, Temp, AppData, or ProgramData) which is a known technique used by malware like InstallFix to execute newly downloaded stages.
GraphWorm Writes Shell
Cortex XDR
Detects the creation of the distinctive 'beacon_shell_output.txt' file in common temporary directories (Temp, AppData, ProgramData) after command execution, which is indicative of GraphWorm (Webworm) activity.
Detects unauthorized file writes to specific Google Chrome extension directories associated with the VILE ransomware. The rule monitors for file creation or modification events targeting known extension paths or files with the .vile extension suffix, indicating potential persistence or malicious extension installation.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Detects an iox-derived proxy process generating a key and initialisation vector while configuring hard-coded forwarding settings. This behavior is indicative of the SmuxProxy malware, which is known to use these techniques for encrypted communication and data forwarding.
Identifies the fake VPN installer executing process hollowing, spawning suspended legitimate .NET binaries (RegAsm.exe, InstallUtil.exe) to inject the Vidar or Lumma stealer payload.
Detects the execution of .bat or .cmd scripts disguised as VPN installer components utilizing curl or wget to pull down malware.
Detects background JavaScript workers injecting helper files to ensure the extension remains active. This rule specifically looks for the creation of files named 'helper.html', 'dream.html', or 'dream.js' within the Microsoft Edge extension data folder, which is indicative of the SNOWBELT malware's persistence mechanism.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Page 120 of 232