Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.
This rule detects network connections to subdomains of 'generate.2faplugin.org' using a regular expression. This infrastructure is associated with a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins were distributed via official channels. The regex is designed to catch varying subdomains related to this malicious infrastructure.
This rule detects Node.js processes executing JavaScript files with exactly 24 hexadecimal characters in their filename from temporary directories (temp or tmp). This pattern is associated with the Mastra NPM supply chain compromise.
Detects if multiple distinct node.exe processes attempt to connect to known easy-day-js C2 IPs within a short span, indicating potential compromise related to the Mastra NPM supply chain attack.
Detects the execution of the SPECTRALVIPER binary or script, a core backdoor component in the Miasma toolkit used for persistent remote access and command execution. This rule specifically looks for process creation events where the filename or command line contains 'spectralviper'.
Detects the execution of 'tanstack_runner.js', which is identified as a specific payload dropped during a compromised tanstack npm supply chain incident linked to Miasma. The rule looks for command-line executions involving 'node' or 'bun run' with 'tanstack_runner.js'.
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
Identifies execution of the Python credential stealer script named detect_malware.py, associated with the UNK_DeadDrop phishing campaign.
Detects the execution of 'WinSc32.exe' from the user's temporary directory (AppData\Local\Temp), which is an indicator of the XWorm malware dropper activity.
Detects pythonw.exe or python.exe executing 'udp.pyw' or 'modes.py'. The script 'modes.py' is associated with ModeloRAT.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
Detects download of malware samples from sharing platforms
Detects the creation of specific staging archives and log files used by Lucid Stealer before exfiltration. This rule looks for 'uac.log.txt', 'lucid_err.log', or 'Data_*.zip' files being created in the user's local temporary directory.
Detects execution of installers for Binance, Bybit, MEXC, MetaTrader 5, or Exodus wallets loading CRYPTBASE.dll, linked to credential theft campaigns.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
This rule detects suspicious command-line activity involving `cmd.exe` or `powershell.exe` executing batch files (`.bat`, `.cmd`) or using the `/c copy` command, specifically when targeting common drive letters (C:, D:, E:) and explicitly excluding commands that contain 'recover', 'restore', or 'decrypt'. This pattern is often observed in ransomware operations attempting to encrypt or manipulate files on local drives.
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
This rule detects the delivery of a malicious XSL (Extensible Stylesheet Language) script via HTTP to a client. The detection is based on the HTTP URI containing ".xsl" (case-insensitive) and the file data containing "<msxsl:script" (case-insensitive). This pattern is indicative of an attempt to use XSLT for proxy execution, often associated with techniques like WMIC (Windows Management Instrumentation Command-line) for defense evasion.
This rule detects suspicious command-line activity involving `cmd.exe` or `powershell.exe` executing batch files (`.bat`, `.cmd`) or using the `/c copy` command, specifically when targeting common drive letters (C:, D:, E:) and explicitly excluding commands that contain 'recover', 'restore', or 'decrypt'. This pattern is often observed in ransomware operations attempting to encrypt or manipulate files on local drives.
This rule detects the use of self-signed TLS certificates where both the issuer and subject Common Name (CN) match a suspicious pattern. The pattern specifically looks for CNs that are 5 to 20 alphanumeric characters or hyphens, followed by one of several top-level domains (TLDs) commonly associated with malicious activity: .xyz, .top, .club, .icu, or .pw. This combination of self-signed certificates and suspicious TLDs is often indicative of command and control (C2) communication from malware.
Page 136 of 232