Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution of 'Falcon_module63.vbs', a script associated with the Iranian APT group Seedworm (also known as APT33 or Shamoon). This VBScript is often used in the initial stages of an attack for reconnaissance or to establish persistence.
Detects if multiple different fake AI installers (e.g., DeepSeek and Kimi) are executed on the same machine, indicating a concentrated phishing delivery.
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
This YARA rule detects components associated with the SprySocks malware, specifically looking for the '\Device\RawWNPF' device name in conjunction with kernel concealment-related API strings such such as 'NtQuerySystemInformation', 'nsiproxy', 'FwpmFilterAdd', and 'KdDisableDebugger'. The presence of these strings together indicates potential rootkit activity aimed at hiding malicious processes or network activity.
Detects a manual kernel mapper referencing a Fonts-hosted encrypted driver and PE relocation APIs. The rule looks for specific strings often associated with malicious kernel-mode operations, including references to the Windows Fonts directory, and API calls like ZwAllocateVirtualMemory, RtlImageNtHeader, MmGetSystemRoutineAddress, and DriverEntry, which are indicative of dynamic driver loading and PE header manipulation.
Detects Python processes that import 'unicode.py' and attempt to load 'terminate.dll' during an 'is_color_supported' call. This behavior is indicative of the ZiChatBot dropper, which uses this deceptive function to trigger its malicious payload.
Detects Python loading a .pyd or .so extension from common user-controlled or temporary directories (AppData, Temp, Downloads, Projects, /tmp/, /home/.../Downloads/) rather than a trusted package installation. This behavior is indicative of the InvisibleFerret malware, which uses Cython extensions for its operations.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
This detects the creation of processes with specific, known malicious hashes (identified as 'ProcessId' in the rule logic, but likely representing image hashes). It monitors Windows Security Event Log (EventID 4688) for process creation events and triggers when a process's identifier matches one of the predefined indicators of compromise (IOCs). This indicates the execution of a known Trojan or other malicious software.
Detects execution of 'transformers.pyz', a zipped Python payload associated with the Miasma toolkit, by monitoring process creation events for command lines containing both 'python' and 'transformers.pyz'.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Identifies the execution of the ClientDelete command designed to wipe traces of the Realtek-disguised malware from the disk. Specifically, it looks for 'cmd.exe' executing a 'del' command with 'RealtekAudio' in the path, which is a known pattern for AsyncRAT self-deletion.
Detects the Gamaredon implant executing DNS resolution checks through the public proxy utility check-host.net to map active fast flux IPs. This activity is initiated by wscript.exe or mshta.exe.
This rule detects consecutive TLS application data records with 32-byte encrypted payloads. This specific record pattern has been observed during AsyncRAT encrypted communication. The rule is port-independent and serves as a supporting indicator for AsyncRAT activity, rather than a standalone high-confidence signature.
Detects the creation of named pipes associated with newly created hex-named executables, indicating Makop multi-threaded coordination. The rule correlates file creation events for executables with hexadecimal names (e.g., '64-character-hex.exe') with subsequent named pipe creation events by the same process within a 10-minute window on the same device. This behavior is indicative of Makop ransomware's inter-process communication mechanism.
Detects file modifications containing specific threat actor emails associated with a Makop ransomware variant. This rule looks for file rename or creation events where the filename contains 'stephanielkfujo@web.de' or 'stephanielklfujo@web.de'.
This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.
Correlates the execution of an executable initiated by cscript.exe with the subsequent access of Chrome's 'Login Data' file, indicating an attempt at offline DPAPI decryption, potentially by the Laravel Stealer malware.
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
Page 129 of 232