Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects PowerShell executing base64 encoded payloads or the string "I am not a robot" typically associated with FakeCaptcha malware found in the clipboard. This rule specifically looks for these indicators within the process command line of PowerShell or pwsh processes.
Detects network connections to 'bsc-testnet.drpc.org', which has been associated with ClearFake and Etherhiding malware campaigns. This domain is used for command and control or data exfiltration related to these threats.
Detects the use of curl with specific command-line flags (-kfsSL) commonly used by Amos Stealer to silently download its initial payload, bypassing TLS warnings and hiding output. This behavior is indicative of an adversary attempting to transfer tools or malware onto a system without user interaction or visible output.
Detects non-Discord processes downloading from Discord CDN attachment endpoints (cdn.discordapp.com/attachments or media.discordapp.net). This activity is often associated with malware families like Lumma and AsyncRAT using Discord CDN to host and deliver stage-2 payloads.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects the execution of 'curl' with specific flags ('-kfsSL') often used for silent and insecure file downloads. This pattern has been observed in malware like Amos Stealer to download malicious payloads. The rule looks for 'curl' as the filename or at the beginning of the command line, combined with the specified flags and an HTTP/HTTPS URL.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.
Detects the creation of processes with command-line arguments containing keywords associated with Conti ransomware, such as 'conti', 'conti-drop', or 'conti-payload'. This rule monitors Windows Security Event ID 4688, which logs process creation.
This rule detects the execution of 'cmd.exe' with a command line that includes 'type', '.pdf', 'more', and 'findstr'. This specific combination of commands is indicative of a technique used by AsyncRAT to extract and execute malicious code hidden within a decoy PDF file by reading specific line ranges.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Tracks the escalation of a Potentially Unwanted Program (PUP) installer executing wscript.exe, which then spawns powershell.exe, finally culminating in the execution of the AutoIt3 interpreter. This sequence is indicative of a common Remote Access Trojan (RAT) loader technique.
Identifies rundll32.exe executing payloads where the exported function name is highly anomalous (over 10 characters, randomized alphanumeric). This behavior is often associated with malware loaders attempting to evade detection by using dynamically generated or obfuscated export names.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
This rule detects the execution of 'curl.exe' that initiates a network connection to the domain 'kak.is'. This activity is indicative of the UnregStealer malware attempting to fetch additional components or communicate with its command and control (C2) server.
Detects command-line execution patterns associated with the BumbleBee malware loader, specifically looking for process names like 'secur.exe', 'secure.exe', 'update.exe', or the string 'bumblebee' within the command line arguments.
Page 128 of 232