Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the creation of common ransomware note file names with suspicious extensions.
Detects network connections to known REvil ransomware domains
Detects SystemSettings.exe executing from any directory other than its legitimate location (C:\Windows\ImmersiveControlPanel\). This behavior is indicative of DLL side-loading, often used by malware like SharkLoader to execute malicious SystemSettings.dll.
Detects the creation of various payload and configuration files (VBS, BAT, AHK, PS1, or files containing 'Subtitles') inside the 'Microsoft.WindowsSoundDiagnostics' directory, which is a known technique used by malware like AsyncRAT to evade detection.
Detects the automated installation of the malicious 'google-update-support' VSIX extension, which has been associated with the UNK_DeadDrop phishing campaign targeting developers.
Detects scripts extracting malicious code hidden within PGP Private Key blocks inside decoy documents, often associated with malware like AsyncRAT. The rule specifically looks for command-line executions that contain the string "BEGIN PGP PRIVATE KEY BLOCK" along with PowerShell commands like "Get-Content" or "gc".
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Identifies the creation of scheduled tasks masquerading as Realtek audio services for persistence, often associated with AsyncRAT.
This rule detects a high volume of file rename events where the new file extension is not a commonly known good extension. This behavior is often associated with ransomware encrypting files and changing their extensions, or other forms of data destruction. The rule filters out common system directories to reduce false positives and aggregates events by process and device to identify the source of the suspicious activity.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the Pony malware credential harvesting sequence where a non-system process performs repeated interactive logon attempts (LogonUserA dictionary brute force via NetUserEnum) against local accounts and achieves at least one successful logon, after which LoadUserProfileA is used to impersonate the compromised account and harvest profile-scoped credentials.
Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.
Detects rundll32.exe executing a DLL calling the 'Begin' export function, which is associated with the ErrTraffic malware. The rule specifically looks for rundll32.exe processes with command-line arguments containing 'Begin' and hidden window parameters like '-Window Hidden' or '-WindowStyle Hidden'.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count of such executions within an hour from a single device is flagged to identify potential phishing attempts or malware delivery.
Detects suspicious execution of VBScript (.vbs, .vbe) files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent notifications. This rule specifically looks for multiple occurrences (3 or more) within an hour, indicating potential malicious activity like phishing or malware delivery.
This rule detects the execution of specific Python scripts associated with the 'FortiBleed' campaign. These scripts include 'spray_da.py' (domain admin password spray), 'smb_test.py' (SMB validation/lateral movement), 'spider.py' (Active Directory crawler), and 'ad_full_audit.py' (Active Directory full audit). Detection is based on the Python executable (python.exe, python3, etc.) running with these script names in the command line or as the executed file.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Page 123 of 232