Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,161
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.
Detects portable Node.js binaries executing from C:\ProgramData, which can be indicative of malware like Lorem Ipsum or EtherRAT. This rule specifically looks for 'node.exe' processes running from the 'C:\ProgramData\' directory with a command line containing '.js'.
Detects registry run key persistence using a specific pattern 'Install Microsoft Teams v0.*' in the RegistryValueName, indicating potential backdoor activity.
Detects evidence of Donut shellcode execution by monitoring 'mscoree.dll' image loads initiated by Python processes. Donut is an open-source tool used to generate position-independent shellcode, often for injecting malicious payloads into memory. This rule specifically looks for scenarios where Python is used as the initiating process for loading the .NET runtime library 'mscoree.dll', which can be indicative of Donut shellcode execution.
Detects a mining process launched with a stratum endpoint, wallet address, worker name, or GPU algorithm arguments. This rule identifies common cryptocurrency mining software (xmrig, lolminer, phoenixminer, nbminer, minerd, miner) when executed with command-line parameters indicative of connecting to a mining pool or specifying wallet/algorithm details.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
Detects .NET processes creating a high volume of files with random 4-character extensions, excluding common temporary and log files. This behavior is indicative of the Chaos ransomware, which MuddyWater has used as a distraction for espionage.
Detects Discord Update.exe launching Discord through the processStart switch when started by an unusual parent. This behavior is indicative of potential malware, such as VVS Stealer, which might replace Discord core files and then use this method to load injected JavaScript into a fresh application session.
Detects execution or file activity involving SHA-256 hashes attributed to analyzed VVS Discord Stealer samples. This rule provides high-confidence indicator coverage and should be retained as supporting intelligence alongside the behavioral detections in this pack.
This rule detects suspicious process creations where the command line contains keywords indicative of keylogger activity (e.g., 'keylog', 'keystroke', 'inputmanipulator', 'spyware') combined with installation-related keywords (e.g., 'install', 'create', 'load', 'run'). It aggregates these events by computer and user over one-hour intervals to identify potential keylogger installation attempts.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects the execution of processes with filenames commonly associated with malicious scripts, exploits, or malware. This rule monitors Windows Security Event ID 4688 (process creation) for specific filenames such as 'malware.ps1', 'payload.vbs', 'exploit.js', 'attack.bat', 'backdoor.cmd', 'dropper.exe', 'loader.exe', and 'injector.exe'.
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects proxy execution of the Vidar secondary payload (agt.dll) using rundll32.exe, specifically targeting behaviors observed in the Operation Turb00 campaign. This rule identifies instances where rundll32.exe is used to load 'agt.dll', which is a known indicator for Vidar malware.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
Page 131 of 232