Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
This rule detects the loading of known vulnerable drivers (BYOVD) or drivers from suspicious user-writable paths, combined with the termination of security products. This combination of events is highly indicative of an adversary attempting to gain kernel-level privileges and disable defenses.
Detects the execution of specific file names and directory combinations used by the GRAT malware (Cyber Isnaad Front) to masquerade as legitimate tools before deploying ransomware or wiper modules. Specifically looks for 'Checker.exe.exe', 'WindowsUpdater.exe' in 'C:\ProgramData\', and 'SpellChecker.exe' in '\AppData\Roaming\Microsoft\Spelling\'.
This rule detects when a file, initially received as an email attachment, is subsequently observed on multiple endpoints within a 7-day period. It correlates SHA256 hashes from email attachment logs with device file events to identify widespread propagation of potentially malicious attachments.
Detects web traffic indicating client-side injection loading JavaScript from the known malicious domain hello-mywordl.info, which is associated with a WordPress malware campaign.
Detects Plane9 or Cluster-Overlay style execution from AppData or other user-writable staging paths, which is indicative of malware associated with the UAC-0184 threat actor.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Detects Microsoft Defender AV alerts associated with the GigaWiper signature, indicating the presence of the GRAT wiper component deployed by Cyber Isnaad Front.
Detects network connections to known CountLoader C2 domains based on McAfee Labs analysis. This rule identifies outbound network traffic from devices to a predefined list of Command and Control (C2) domains associated with the CountLoader malware. The detection logic specifically looks for the presence of these domains in the 'RemoteUrl' field of network events.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
This rule detects potential ransomware activity by identifying a high volume of file encryption events. It looks for files being renamed or created with common ransomware-related extensions such as '.locked', '.crypt', '.encrypted', '.enc', or a generic pattern of a 6 or more character alphanumeric extension. The rule then counts these events within one-hour bins and alerts if more than 20 such files are detected in a single folder path.
Detects file access attempts targeting the erroneous SysWOW64 path for Kaspersky drivers. This is a specific bug and a high-confidence indicator of Amatera Stealer's anti-sandbox and evasion checks. The malware specifically looks for 'klif.sys', 'kldisk.sys', 'klhk.sys', and 'kneps.sys' within the incorrect '\Windows\SysWOW64\drivers' directory.
Detects the specific command execution wrapper used by the Rust-based HelloDoor malware (part of the Kimsuky PebbleDash cluster). The malware sets the code page to 65001 (UTF-8), suppresses output to nul, and chains the execution of a payload using cmd.exe.
Identifies network connections to known C2 and dropper infrastructure associated with the Amatera Stealer 4.0.2 Beta and ClickFix campaign. Network indicators provide a reliable detection mechanism for compromised hosts attempting to download secondary payloads or exfiltrate data.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
This rule detects network connections to the Telegram API (api.telegram.org) originating from processes that are not recognized as legitimate Telegram applications (e.g., chrome.exe, Telegram.exe). This behavior can indicate the presence of malware or other unauthorized applications attempting to exfiltrate data or establish command and control via the Telegram messaging platform.
Systeminfo.exe Making Network Connection
Cortex XDR
Detects network connections originating from the systeminfo.exe process. This activity is suspicious because systeminfo.exe is a legitimate system enumeration tool not typically expected to initiate outbound network connections. This behavior has been observed in malware campaigns, such as CountLoader, which injects a cryptocurrency clipper into systeminfo.exe to communicate with C2 servers and the Ethereum blockchain.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Page 160 of 232