Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Tycoon2FA Malicious S3 Lure Access
Cortex XDR
Detects DNS queries pointing to a specific malicious AWS S3 bucket URL known to be utilized by the Tycoon2FA threat actor for hosting initial cloned Microsoft Power Pages lures. This rule identifies network activity attempting to resolve this highly specific Indicator of Compromise (IOC).
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects suspicious npm activity indicative of the PhantomRaven Wave 5 supply chain attack. This includes node.js processes executing scripts from temporary directories during npm install, node.js processes accessing credential files (.gitconfig, .npmrc, .aws/credentials, .ssh) during npm lifecycle events, and the installation of known malicious npm package names associated with PhantomRaven.
Detects the creation of a scheduled task named 'WindowsHelper', which is used by Operation HumanitarianBait for persistence to launch its Python implant every 5 minutes. This rule specifically looks for command-line executions of 'schtasks.exe' or commands containing 'schtasks' that include '/create' and the task name 'WindowsHelper'.
Detects the execution of 'module.pyw' using 'pythonw.exe', which is a technique employed by Operation HumanitarianBait to silently run an infostealer. This rule specifically targets the combination of the windowless Python interpreter and the known payload script name.
Detects pythonw.exe executing .pyw scripts from user-writable directories outside canonical Python installation paths. This execution pattern is used by Operation HumanitarianBait (module.pyw from %APPDATA%\WindowsHelper) and similar PyArmor-packed Python infostealer campaigns like PXA Stealer and JarkaStealer. These campaigns drop self-contained Python environments into vendor-mimicking AppData subdirectories. The rule catches the specific HumanitarianBait path/script combination and variants that alter the path or script name while maintaining the windowless-Python-from-AppData primitive.
This rule detects various activities associated with CloudZ and Pheno malware, including persistence mechanisms via scheduled tasks, execution of .NET loaders (regasm.exe), payload downloads using common utilities (curl, powershell, bitsadmin) from known staging patterns, reconnaissance artifacts, and network connections to known CloudZ infrastructure.
This rule detects network connections to the Telegram API (api.telegram.org) originating from processes that are not recognized as legitimate Telegram applications (e.g., chrome.exe, Telegram.exe). This behavior can indicate the presence of malware or other unauthorized applications attempting to exfiltrate data or establish command and control via the Telegram messaging platform.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
This rule detects the creation of files matching the exfiltration pattern used by the Mini Shai-Hulud malware. Specifically, it looks for files named 'results-<timestamp>-<counter>.json' within a 'results' directory, accounting for both Windows and Unix path separators. This pattern is indicative of data staging or exfiltration activities by the malware.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Identifies when Microsoft Defender for Endpoint blocks or quarantines a file, extracting the malicious SHA256 hash. This rule specifically looks for `DeviceEvents` and `DeviceFileEvents` where an action type indicates a block or quarantine, and then extracts additional details like `ThreatName` and `AvAction` to confirm the successful intervention. It also includes an exclusion list for known benign hashes like EICAR.
Detects the execution of the 'dvr' downloader script and subsequent 'nexuscorp' payload executions used by the Nexcorium Mirai variant botnet. This rule specifically looks for `wget` downloading 'dvr' from an IP address, direct execution of './dvr', or execution of 'nexuscorp' with an architecture-specific 'dvr' payload.
Detects the creation of 'vector_notice.sh' in '/etc/profile.d/', a shell script dropped by VECT ransomware on Linux systems to display its ransom note upon user login. This rule specifically looks for file creation events on Linux systems where the target file name matches the exact path '/etc/profile.d/vector_notice.sh'.
Detects the loading of known vulnerable drivers commonly abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass Driver Signature Enforcement (DSE) and gain Ring 0 execution.
Detects the creation of an executable file named 'sysd' in the '/usr/local/bin/' directory on Linux systems. The Nexcorium Mirai variant copies itself to this location to masquerade as a legitimate system process for persistence. This specific file name is not a standard Linux system daemon.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Page 161 of 232