Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects a single compromised host initiating a massive burst of outbound SMB (Port 445) connections, indicating the push of the ransomware encryptor to the entire domain.
Detects a deceptive 'Updater' or Adware installer dropping heavily packed, randomized executables into the %TEMP% directory, transitioning from nuisance to active malware. This rule correlates file creation events in the temporary directory with process creation events initiated by common installer/updater filenames.
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
This rule detects the creation or modification of executable files (.exe) within the 'AppData\Roaming' directory, excluding common legitimate application subfolders (Microsoft, Adobe, Mozilla, Skype, Notepad++). The detection is further refined by correlating these file events with processes that have specific version information (FileDescription, OriginalFileName, or ProductName) matching 'TuglaInsaatci' or 'oacY.exe'. This pattern is indicative of potential malware or unwanted applications attempting to establish persistence or execute from user-specific application data folders.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects malicious UnityPlayer.dll reading the encrypted Com.dat container for decryption routines, indicative of the 'Dragon Weave' campaign.
Detects HTTP GET requests for JavaScript or CSS resources from netdna-ssl.com or wpengine.netdna-ssl.com subdomains. This activity could indicate a supply chain compromise where malicious code is injected into legitimate web resources served from these content delivery networks.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Detects network connections to a specific Google Drive document ID known to be associated with the 'Steam Wallpaper' attack for payload distribution.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.
Tracks the process tree where a Fake AI installer (deepseek*, ProFluxeFlowAi*, etc.) executes and writes pythonw.exe to disk. This activity is indicative of social engineering attacks leveraging the popularity of AI tools to deliver malicious Python-based loaders.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
Detects w3wp.exe directly passing backdoor files as command line arguments to a PHP runtime. This activity is indicative of a supply chain compromise where malicious PHP files are executed by the IIS worker process.
Detects execution of specific AutoHotkey (AHK) scripts associated with AsyncRAT, where threat actors abuse AHK to reflectively inject .NET remote access trojans.
Detects scheduled tasks named "CheckRealtekAudioVersion" or "RealtekAudioEnhancements64" created for AsyncRAT persistence. This rule specifically looks for the execution of 'schtasks.exe' with the '/create' argument and the presence of these specific task names in the command line, which are known indicators of AsyncRAT establishing persistence.
Page 122 of 232