Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects potential ransomware activity by monitoring Windows Security Event ID 4657 (Registry Value Modified) for specific keywords commonly associated with ransomware notes or demands. It looks for terms like 'ransom', 'payment', 'decrypt', 'unlock', 'bitcoin', and 'monero' within the new value of a modified registry key, specifically within the 'Run' or 'Software' registry paths. This could indicate a ransomware variant attempting to establish persistence or store its ransom note details in the registry.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
This rule detects the creation of processes with command-line arguments indicative of 'Playground' ransomware activity. It specifically looks for 'playground', 'pgd-ransom', or 'playground-drop' in the command line of newly created processes (EventID 4688).
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
Identifies when DeepLoad target processes (LockAppHost.exe, makecab.exe, Magnify.exe) spawn child processes like shells (cmd.exe, powershell.exe, whoami.exe, net.exe), indicating successful injection and post-exploitation execution. This behavior is associated with the DeepLoad malware.
Detects endpoint connections to infrastructure utilized by SmartApeSG after compromising the Okendo Reviews widget. Specifically, this rule looks for network connections to the domains 'api.wigetticks.com' and 'api.wizzleticks.com', which have been associated with the SmartApeSG supply chain attack targeting the Okendo Reviews widget.
Advanced time-series detection of a single installer process dropping both a known RMM tool artifact and an anomalous executable within 10 seconds.
Correlates the creation of the RESTORE_FILES.txt or GENTLEMEN_README.txt ransom note in multiple directories across the file system, specifically when more than 5 notes are created within a minute by the same process on a device.
Detects Windows Explorer executing an LNK file that directly spawns PowerShell to download the next-stage tax lure payload. This pattern is indicative of a phishing attack attempting to deliver malicious content.
Correlates the malicious executable launching the embedded decoy .docx document to divert user attention during infection.
Identifies the usage of CreateProcessA launching a random 6-character executable with a detached or null parent structure, potentially indicative of the Silent Rotor malware's execution strategy. The rule specifically looks for executables with a 6-character alphanumeric filename (e.g., 'abc123.exe') and either no initiating process or an initiating process named 'Подтверждение заказа продукции ЦАИ.exe'.
Detects a dropper deriving a decryption key from hostname or machine attributes before unpacking a second-stage module. The rule specifically looks for process command lines containing keywords related to hostname/computername/machineguid/volume serial combined with decryption-related terms like decrypt, aes, xor, payload, or byte array.
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Page 130 of 232