Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the execution of a specific Chinese-named payload, '_計畫申請審查結果通知單.exe', which is associated with the Dragon Weave campaign and the AZUREVEIL attack flow. It also correlates this process execution with the presence of 'BrowserViewUtility.exe' as an initiating process file event, indicating a multi-stage infection.
Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.
Detects PowerShell invoking Add-Type to compile C# code inline, indicative of PS1Bot malware. Specifically looks for the use of 'Add-Type' in PowerShell command lines combined with specific C# methods like 'SetWindowsHookEx', 'Graphics', or 'CopyFromScreen', which are often used for screen capture or other malicious activities.
Detects the Steam application wallpaper (wallpaper32.exe or wallpaper64.exe) launching a hidden executable named ._cache_GAME1.exe. This behavior is indicative of malicious wallpapers found on the Steam Workshop that use this method to execute malware.
Detects Havoc C2's Sleep Obfuscation (Ekko/FOLIAGE) technique where a process creates remote threads into itself with suspicious start addresses to hide its memory while sleeping. This rule specifically looks for CreateRemoteThread API calls where the target process is the same as the initiating process, excluding common legitimate processes like chrome.exe, msedge.exe, and svchost.exe.
This rule detects continuous C2 beaconing activity associated with Matanbuchus malware. It specifically looks for network connections originating from 'svchost.exe' or 'dllhost.exe' to common web ports (80, 443, 8080) with a high frequency (more than 10 beacons) within a 5-minute window. This behavior is indicative of a hollowed process establishing command and control communication.
Correlates the final execution of a dropped ransomware binary directly from the C:\ProgramData\JWrapper or related SimpleHelp cache directories, identified by common ransomware flags in the process command line.
Detects the AMOS Stealer archiving collected data using the 'ditto' command with specific flags and output file names. This rule identifies the use of '-c', '-k', and '--sequesterRsrc' flags, along with '/tmp/osalogging.zip' or '/tmp/out.zip' as target archive names, which are characteristic of AMOS Stealer's data staging and archiving behavior.
End-to-end correlation: Fake AI installer executes -> Drops pythonw.exe -> Network connection to Vidar C2.
Detects pythonw.exe accessing multiple distinct browser credential stores within a tight 2-minute window, indicative of information stealer behavior (e.g., Vidar stealer). The rule specifically looks for access to 'Login Data', 'Cookies', 'Web Data', and 'places.sqlite' files.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects the execution of specific Node.js scripts (`setup.cjs` or `protocal.cjs`) that are associated with the Mastra npm supply chain attack. It identifies Node.js process executions across Windows, macOS, and Linux, looking for these malicious script names in the command line.
Detects network connections related to Xworm malware family indicators
This rule detects the presence of files on devices that match known ransomware SHA256 hashes. It filters out common system processes (explorer.exe, svchost.exe, system.exe) as initiating processes to reduce false positives.
Detects the execution of processes with command lines containing keywords associated with FormBook RAT, initiated by common scripting interpreters like PowerShell, cmd, or wscript. This rule aims to identify potential FormBook RAT loader activity.
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
This rule detects the execution of processes with command lines containing keywords associated with Snake Keylogger, such as 'snake', 'snakekeylogger', 'keylog.exe', or 'logger.dll'. This indicates potential keylogger activity on the endpoint.
Detects the creation or modification of registry run keys that establish persistence by executing programs from user-specific application data folders (AppData\Roaming or %APPDATA%) with randomized names. This rule specifically excludes legitimate Windows and Program Files paths to reduce false positives.
This rule detects network connections to remote URLs containing indicators associated with the XWorm Remote Access Trojan (RAT). It specifically looks for 'xworm', 'x-worm', 'wormx', or '/xworm' within the RemoteUrl field of DeviceNetworkEvents.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Page 125 of 232