Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
Detects network connections initiated by 'backgroundTaskHost.exe' to known Remcos C2 infrastructure, specifically targeting 'duckdns.org' or communicating over port 53552. This rule aims to identify potential Remcos RAT activity.
This rule detects the execution of processes with command-line arguments indicative of AvosLocker ransomware activity. It specifically looks for keywords such as 'avoslocker', 'av0s', 'locker-payload', and 'av0s-ransom' within process command lines, which are known indicators of this ransomware.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
This rule detects the execution of 'VmwareSampling.exe' with a command line containing 'victimtoolsalla.dll'. This specific combination is indicative of the NIGHTFORGE loader, which often leverages DLL side-loading techniques to execute malicious payloads. The presence of 'victimtoolsalla.dll' suggests an attempt to load a malicious DLL via a legitimate VMware process.
Detects vcpktsvr.exe loading a local libcef.dll associated with the non-standard cef_api_mash export used by ZiChatBot.
Detects a hidden or borderless topmost window created by a non-browser process while an online banking session is active, specifically looking for processes named 'banana', 'client', 'update', or 'service' with command-line arguments indicating a full-screen or overlay window related to banking, updates, or security.
This rule detects the execution of self-extracting (SFX) archives that launch both a visible decoy and a hidden second executable from the temporary directory. It specifically looks for process command lines containing patterns indicative of 7-zip or generic SFX archive execution, combined with an actor process image name suggesting an archive utility or installer. The rule aims to identify malicious SFX archives used in multi-stage attacks, providing causality fields for investigation.
NSIS InetLoad downloader user agent
Cortex XDR
This rule detects the distinctive 'NSIS_InetLoad Mozilla' user-agent string, which is commonly used by staged downloaders. It specifically targets network events where the process image name ends with '.exe' and either the event subtype or the remote IP contains the 'NSIS_InetLoad Mozilla' string. The rule aims to identify the initial stages of malware delivery and execution, providing causality fields for investigation.
This rule detects outbound HTTP connections to Cloudflare Workers URLs that match the dynamic, date-derived campaign folder parameters used by the GammaDrop malware. Specifically, it looks for URLs ending with a pattern like '/[A-Za-z0-9-]+/[a-z]+/[0-9]{2}.[0-9]{2}.[0-9]{3}/[0-9]+.(tif|bmp)'. This pattern is indicative of GammaDrop's command and control (C2) communication.
Detects the creation of an executable with a 64-character hexadecimal filename, which is a common pattern for Makop ransomware variants when dropping their payloads.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detect Tiny Vbs
YARA
This YARA rule detects Visual Basic Script (VBS) files that contain common keywords often used in malicious VBScripts. Specifically, it looks for the presence of 'Dim' (for variable declaration), 'Wscript.Shell' (to interact with the operating system shell), 'End Function' (a VBScript construct), and 'CreateObject' (to create COM objects). The rule is designed to identify potentially malicious VBS files, possibly used for execution, persistence, or other adversarial activities.
This rule detects potentially malicious PDF files that act as droppers. It looks for a valid PDF header combined with specific PDF object patterns (Catalog, Pages, Page, FlateDecode) and indicators of malicious activity. These indicators include commands to launch chrome.exe, launch actions, obfuscated JavaScript for data export, or an 'anonymous' author field, which can be used by malware families like win.cloudeye.
This rule detects outbound network connections to 'minemine.gleeze.com' on port 8443 originating from specific .NET utility processes (InstallUtil.exe, RegAsm.exe, MSBuild.exe). This activity is indicative of cryptojacking, specifically a campaign abusing ScreenConnect and .NET utilities for GPU mining, as described in the referenced Microsoft blog.
Detects the disguised SoftwareLicencing.exe reaching out to external networks rather than internal KMS servers, as observed in the 'Screening Serpens' campaign attributed to Iranian APT groups.
This rule detects outbound Command and Control (C2) beaconing activity by the `UpdateChecker.dll` to Azure Websites, which is indicative of the Screening Serpens APT group. It specifically looks for the loading of `UpdateChecker.dll` followed by network connections to domains ending in `azurewebsites.net` from the same initiating process.
Detects InterlockRAT activity by identifying Java runtime executions (java.exe or javaw.exe) that include the '-jar' argument and originate from suspicious folders like AppData\Local\Temp, ProgramData, or Public. InterlockRAT is known to leverage Java runtimes to establish persistent SOCKS5 tunnels and reverse shells.
Page 124 of 232