Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential DarkCloud RAT activity by looking for specific strings in process command lines. The strings 'darkcloud', 'dark.cloud', 'cloud.dll', or 'shadow.exe' are indicative of the RAT's components or communication patterns.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
Correlates the user mounting a tax-themed ISO archive followed by the execution of a binary establishing a Remcos RAT C2 connection.
Identifies the hallmark behavior of AgentTesla (frequently delivered via tax lures) injecting into RegAsm and attempting SMTP/FTP exfiltration.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
Detects PowerShell commands that contain a reversed string pattern often used by Vidar malware to de-obfuscate its C2 endpoint at runtime. The specific pattern 'txt.[0-9a-zA-Z]+/selif_cilbup' is indicative of this technique.
Identifies XWorm dynamically identifying and invoking the Run method of a reflected plugin assembly using .NET late binding. This detection specifically looks for 'LdrLoadDllApiCall' events where 'mscoree.dll' is loaded by a process whose filename matches 'Win.Kernel_Svc'.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders. Specifically looks for .pyc files with 20 or more alphanumeric characters in their name, created in a temporary folder path matching the pattern '_MEI[0-9]+'.
Correlates the dropping of the decrypted XWorm payload into %LOCALAPPDATA% with a name mimicking a Windows Kernel service.
Detects DC-RAT by matching complete static API/function and string fingerprint.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
Detects the creation or modification of registry run keys that establish persistence by executing programs from user-specific application data folders (AppData\Roaming or %APPDATA%) with randomized names. This rule specifically excludes legitimate Windows and Program Files paths to reduce false positives.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
This rule detects suspicious file activity indicative of Prinz Eugen ransomware. It looks for the creation of multiple files (100 or more) with the '.prinzeugen' extension and a file size of at least 1KB, which suggests encryption activity.
This rule detects potential ransomware activity by identifying the rapid encryption of multiple common document and database file types, indicated by the '.prinzeugen' extension. It specifically looks for at least 20 such files being created or modified within a 10-minute window on a single device.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
Page 126 of 232