Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects network traffic containing the string "/..namedfork/rsrc" (case-insensitive) over TCP to port 22 (SSH). This pattern is indicative of an attempt to use macOS resource forks to hide payload data, a technique often employed by malware for defense evasion. The detection specifically targets traffic originating from and destined for the home network, suggesting an internal system attempting to exfiltrate or receive hidden data.
This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.
This rule detects network traffic containing the strings "SW_HIDE" and "CreateProcess" within file data in an HTTP response. This combination suggests an attempt to execute a process with a hidden window, which is a common technique used by malicious software to evade detection.
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.
Detects network connections to known HarborWatch C2 server IPs and associated fake-Amazon infrastructure domains, directly identifying compromised hosts communicating with this threat actor's infrastructure.
This rule detects potential command and control (C2) channel activity by identifying HTTP requests where the URI contains specific keywords commonly associated with C2 infrastructure switching or staging. The keywords include 'stage2', 's2', 'next', 'pivot', and 'relay'. This indicates an attacker might be moving to a new phase of their operation or redirecting C2 communications.
This rule detects DNS queries for 'pastebin.com' that occur at a high frequency (5 times within 60 seconds from the same source IP). This pattern is indicative of a Dead Drop Resolver Command and Control (C2) mechanism, where attackers use services like Pastebin to host C2 instructions or data, and malware frequently queries these services to retrieve commands or exfiltrate data. The rule specifically targets DNS traffic on port 53.
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
Detects process execution events containing command-line arguments unique to Chaos ransomware execution, such as 'ignorar_arquivos_grandes' or 'work_mode'. It also includes a more generic detection for 'lkey' and 'path' arguments used together to reduce false positives.
This rule detects the execution of processes with command-line arguments indicative of AvosLocker ransomware activity. It specifically looks for keywords such as 'avoslocker', 'av0s', 'locker-payload', and 'av0s-ransom' within process command lines, which are known indicators of this ransomware.
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.
This rule detects the creation of processes with specific, known malicious hashes (identified as 'ProcessId' in the rule logic, but likely representing image hashes). It monitors Windows Security Event Log (EventID 4688) for process creation events and triggers when a process's identifier matches one of the predefined indicators of compromise (IOCs). This indicates the execution of a known Trojan or other malicious software.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
Hades Sentinel File Creation
Cortex XDR
Detects the creation of the '.bun_ran' sentinel file in the system temp directory, used by the Hades malicious PyPI loader to avoid repeated executions. This file acts as a marker to prevent subsequent infections or executions of the malware.
This rule detects network traffic indicative of a compromised host attempting to beacon to a botnet command and control server. Specifically, it looks for HTTP requests where the URI path contains "/gate.php". This pattern is commonly associated with botnet communication.
Page 148 of 232