Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the malware copying itself into the localized cache directory under the hardcoded campaign ID D3F4E2A1, specifically looking for 'RuntimeHost.exe' being created in that path.
Tracks processes (specifically hollowed svchost) generating high-volume, long-duration network sessions over port 4444, characteristic of Showboat's internal SOCKS5/Portmap routing.
Identifies the compromised ScreenConnect.ClientService.exe initiating network traffic to a known malicious command and control (C2) server associated with cryptojacking activities. The detection specifically looks for connections to 'directdownload.icu' or the IP address '193.42.11.108'.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
Detects the execution of an executable from the temporary ScreenConnect application directory. This behavior has been observed in recent malvertising campaigns where rogue ScreenConnect instances are used to deploy and execute multi-stage crypters (e.g., FatMalloc/crypteds.exe) from this directory, initiating ransomware and BYOVD payloads.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects process execution where the command line contains keywords indicative of inline assembly or native code injection (e.g., 'shellcode', 'payload', 'bytecode', 'native', 'runtime') and the process is one of several common executables ('servertool.exe', 'encrypt.exe', 'powershell.exe', 'cmd.exe'). This behavior is often associated with malware, including ransomware, attempting to execute malicious code.
Detects the Prinz Eugen ransomware's encryption binary ('servertool.exe') spawning common system utilities ('cmd.exe', 'powershell.exe', 'net.exe', 'wmic.exe', 'taskkill.exe'). This behavior is indicative of the ransomware preparing the system for encryption or performing post-encryption cleanup/actions.
Detects the creation or modification of registry run keys that establish persistence for the Prinz Eugen ransomware. The rule specifically looks for registry entries under 'Software\Microsoft\Windows\CurrentVersion\Run' that contain common environment variables (e.g., %APPDATA%, %TEMP%) and specific filenames or paths associated with Prinz Eugen ransomware (e.g., 'servertool', 'encrypt.exe', '\Music\', '\Desktop\').
This rule detects the execution of processes named 'servertool.exe' or 'encrypt.exe' that are likely associated with the Prinz Eugen ransomware. The detection logic specifically looks for these executables being run with command-line arguments indicative of multi-threaded or parallel processing, such as 'goroutine', 'threads', 'workers', or 'parallel'. It then counts the number of unique process IDs for these activities within a 5-minute window on a given device and flags if four or more such processes are observed, suggesting a high-intensity encryption operation.
This rule detects network connections to common messaging and data store ports (RabbitMQ, Redis, MinIO) initiated by PowerShell, redis-cli, or minio.exe, where the process command line also contains the string "encrypt". This combination suggests potential malicious activity such as data encryption by ransomware or other malware targeting these services.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
Detects the execution of a Go binary named 'servertool.exe' or any executable containing 'servertool' in its command line, when combined with suspicious command-line arguments indicative of file deletion or directory traversal, while excluding common system directories like 'Program Files' and 'Windows'. This rule aims to identify activity associated with the Prinz Eugen ransomware.
Detects modifications to the 'Run' registry key for persistence, specifically looking for indicators associated with Prinz Eugen ransomware such as 'servertool', 'encrypt.exe', 'lock.exe', or 'ransom' in the registry value data. It excludes common legitimate paths to reduce false positives.
This rule identifies HTTP requests containing specific URL affiliate tracking parameters associated with the "Borrowed Trust" SEO poisoning campaign. The campaign utilizes these parameters to monetize its activities, often redirecting users to gambling sites. Detection is based on the presence of known affiliate codes in `RemoteUrl` from `DeviceNetworkEvents` or `RequestURL` from `CommonSecurityLog` (proxy/firewall logs).
This rule detects a multi-stage command and control (C2) domain rotation pattern by identifying DNS queries for domains that match a specific regular expression. The pattern looks for domains consisting of 6 to 12 lowercase alphanumeric characters followed by one of several top-level domains (xyz, top, icu, club, online). A threshold of 5 such queries from the same source within 60 seconds is used to trigger the alert, indicating potential malicious activity like fast flux or domain generation algorithms (DGAs) used by malware for C2 communication.
This rule detects patterns associated with the APT29 Wineloader backdoor. It looks for the creation of ActiveX objects for Wscript.Shell and Scripting.FileSystemObject, XMLHttpRequest for HTTP requests, specific `certutil -decode` commands, `tar -xf` commands, the presence of `SqlDumper.exe` in a specific path, and generic URL patterns. These indicators suggest potential execution of malicious scripts, file manipulation, data exfiltration, and command and control communication.
This rule detects potential Trickbot malware command and control (C2) communication by identifying network connections to specific remote URLs and ports commonly associated with Trickbot activity. It looks for multiple connections within an hour from the same device to these indicators.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Page 134 of 232