Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
This rule detects a suspicious chain of events starting from a web browser (Chrome, Edge, or Firefox) initiating a process like PowerShell, Cmd, Msiexec, or Rundll32. The detection is further narrowed down by looking for specific command-line arguments related to downloads or temporary directories, and crucially, by identifying that the executed payload is unsigned or has an untrusted signature. This pattern is indicative of malvertising leading to the execution of potentially malicious, unsigned software.
This rule detects the execution of 'VmwareSampling.exe' with a command line containing 'victimtoolsalla.dll'. This specific combination is indicative of the NIGHTFORGE loader, which often leverages DLL side-loading techniques to execute malicious payloads. The presence of 'victimtoolsalla.dll' suggests an attempt to load a malicious DLL via a legitimate VMware process.
Detects instances where an executable is deleted immediately after execution, a common defense evasion technique used by memory-resident malware like the JDY botnet. This rule specifically looks for shell processes executing 'chmod +x' or 'chmod 777' followed by 'rm' commands, often chained with '&&', ';', or '||', indicating immediate self-deletion after execution.
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.
This rule detects HTTP responses containing a payload that appears to be XOR encrypted. It specifically looks for a sequence of at least 200 bytes consisting of non-printable ASCII characters (0x01-0x1f and 0x7f-0xff) within the file data of an HTTP response flowing to the client. This pattern is indicative of XOR encryption, often used by malware to obfuscate its payload.
This rule detects the delivery of a malicious LNK file via HTTP that utilizes icon smuggling. It specifically looks for HTTP responses containing a URI with ".lnk" and the byte sequence "|4C 00 00 00|" at the beginning of the file data, which is characteristic of LNK files. Icon smuggling is a defense evasion technique where a malicious file disguises itself with a legitimate icon to trick users into executing it.
This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects polymorphic malware payloads that mutate to evade static signatures
Detects download of malware source code from code repositories
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
Page 138 of 232