Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Tracks browser network events fetching the dynamic malicious payload pipiteimosa.extension.js, specifically when initiated by Chrome or Microsoft Edge browsers. This activity is associated with the UnregStealer malware, which targets Brazilian banking credentials.
Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.
Detects execution of 'certificado.exe' or 'crtf.exe' leading to the creation of the batch script 'vvvv.cmd' or 'help.bat'. This activity is associated with the UnregStealer malware.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
This rule detects suspicious modifications to Chrome browser extensions by monitoring registry events. Specifically, it looks for changes within the 'Chrome\Extensions' registry key where the 'chrome_settings_overrides' value name is set and its data contains the string 'search'. This pattern is indicative of an extension attempting to hijack browser search settings, often a tactic used by unwanted programs or malware to redirect user searches to malicious or ad-filled sites.
This rule detects network connections initiated by 'bun.exe' to specific IP address ranges (94.154.172.0/24 or 91.195.240.0/24) that have been identified as malicious command and control (C2) infrastructure. This indicates potential compromise of a system where 'bun.exe' is being used for malicious communication.
Detects connections to a known XenoRAT C2 IP address (185.235.137.106) originating from processes other than common web browsers (mshta.exe, chrome.exe, msedge.exe). This aims to identify potentially injected shellcode or RAT processes establishing command and control communications.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Detects any process executing files with .vmxx extensions residing within the anomalous firefx- directories, which is indicative of activity related to Operation XENOFISCAL, specifically the deployment of persistent XenorRAT by the SideCopy threat group.
Correlates the file creation of zuidrt.hta and its execution via mshta.exe, indicating potential malicious activity associated with Operation XENOFISCAL.
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects mass file renaming indicating ransomware encryption activity
Detects the specific Seedworm MSI dropper 'update_ms.msi' executed via msiexec. This rule identifies process execution where 'msiexec.exe' is the process and its command line contains 'update_ms.msi', indicating the execution of a known malicious MSI file associated with the Seedworm APT group.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects the creation or manipulation of mutexes by processes that contain keywords associated with the Remcos RAT (Remote Access Trojan). Specifically, it looks for command-line arguments containing "Remcos_Mutex_Inj", "Remcos_Mutex", "mutex", or "CreateMutex". This activity can indicate the presence or execution of Remcos RAT on a system, as mutexes are often used by malware for single-instance enforcement or inter-process communication.
Detects the execution of MassLogger RAT components where the command line contains 'masslogger', 'mass.logger', or 'logger.exe', specifically when initiated by PowerShell or a process associated with 'RemotePC'. This rule aims to identify the loading or execution phase of the MassLogger RAT.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Page 132 of 232