Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,478
11,861
5,881
5,162
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects background JavaScript workers injecting helper files to ensure the extension remains active. This rule specifically looks for the creation of files named 'helper.html', 'dream.html', or 'dream.js' within the Microsoft Edge extension data folder, which is indicative of the SNOWBELT malware's persistence mechanism.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Correlates the execution of the injected Vidar payload with the dropping of legitimate sqlite3.dll, nss3.dll, or freebl3.dll, which are required to parse and steal browser databases. This rule specifically looks for these DLLs being created on a device where the initiating process was 'AutoIt3.exe', indicating a potential Vidar stealer infection.
Identifies Storm-1175 abusing legitimate enterprise software deployment tools like PDQ Deploy to push the Medusa encryptor to all domain endpoints simultaneously. The rule correlates process events related to PDQ Deploy with file events indicating the creation of files with a '.medusa' extension, which is characteristic of the Medusa ransomware.
Detects the execution of the legitimate AutoIt3.exe interpreter launching a script (either .au3 or .a3x) that also initiates network connections to non-localhost IP addresses. This behavior is indicative of malicious activity, such as that observed with the Vidar stealer.
Identifies when the AutoIt3.exe process accesses cryptocurrency wallet files or directories such as MetaMask, Exodus, Coinomi, or wallet.dat. This behavior is indicative of information stealer malware like Vidar attempting to exfiltrate sensitive cryptocurrency data.
Detects registration or activation of a .NET COM object from a writable path before an in-memory payload is supplied. This rule specifically looks for command-line arguments containing COM-related keywords (regasm, regsvcs, comvisible, clsid, inprocserver32) in conjunction with common writable user-controlled directories (appdata, programdata, temp, users\public).
Detects a module parsing a large in-memory configuration blob without opening an external configuration file in the same start window. This behavior is indicative of the Kazuar malware loading its configuration directly from its executable rather than a separate file, which is a common obfuscation technique.
Detects the Silent Rotor malware transmitting collected system profile as a serialized JSON blob to the C2 domain cdn.kleymarket.ru. The detection specifically looks for network connections to this domain initiated by a process named 'Подтверждение заказа продукции ЦАИ.exe'.
Traces the behavior of Vidar resolving its Win32 APIs dynamically in memory using a byte-by-byte XOR reconstruction loop. This rule specifically looks for `WriteProcessMemoryApiCall` events where the target process is `RegAsm.exe` and the buffer size written is less than 256 bytes, which is indicative of small, dynamic code injection or modification often seen in malware unpacking or API resolution.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects the execution of processes associated with the malicious npm package 'apintergrationpost', which acts as a masquerade for a Linux RAT (Remote Access Trojan) labeled as MYRA. The rule monitors process launch events for command lines or file paths containing the package name.
Detects execution of the Prinz Eugen ransomware 'servertool.exe' accompanied by high-volume file modifications targeting files with the '.prinzeugen' extension. This behavior is indicative of the ransomware's file encryption process, specifically its file system traversal and modification-time sorting strategy used to prioritize recently modified files for encryption.
Detects the OXLOADER malware dropping a renamed copy of dui70.dll with a malicious RWX .xtext section into the user's Temp folder, followed by the loader process reading mpr.dll, which is a known behavior related to its sandbox check and API resolution execution chain.
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects the presence of a cluster of DLL names commonly associated with anti-analysis techniques used by malware, specifically Sprysocks. The DLLs 'snxhk.dll', 'SxWrapper.dll', 'SxIn.dll', 'SXIn64.dll', 'SbieDll.dll', and 'cmdvrt32.dll' are checked by malware loaders to identify sandbox or packet-capture environments. The rule triggers if at least three of these DLL names are found, indicating an attempt by malware to evade detection or analysis.
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects the Linux ZiChatBot component executing from the obsHub temporary directory with the obs-check-update name after being made executable.
This rule detects the creation of a specific named mutex associated with the GreenBlood ransomware encryptor. The mutex name typically starts with 'Global\\GREENBLOOD_ENCRYPTOR_MUTEX_'. The presence of this mutex indicates potential GreenBlood ransomware activity on the system.
Page 121 of 232