Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
This rule detects suspicious network connections to api.telegram.org from processes masquerading as legitimate Windows executables (MicDriver.exe, Winappx.exe, MsCache.exe, RuntimeSSH.exe, smqdservice.exe). It also identifies files with MD5 hashes matching known Indicators of Compromise (IOCs) from an external list. This combination suggests potential malware activity, possibly involving Telegram for command and control or data exfiltration, combined with process masquerading for evasion.
This rule detects artifacts associated with the Auto-Color Linux backdoor. Specifically, it looks for the presence of the malicious library 'libcext.so.2', which mimics a legitimate library, or modifications to '/etc/ld.preload' for persistence and dynamic linker hijacking. It also identifies specific file paths used by the malware, such as '/var/log/cross/auto-color' or files within '/tmp/cross/' with a 'config-err-' prefix.
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
Detects the creation of the specific mutex 'Windows-Updates-KB852654856' used by the BRUSHLOGGER keylogger to enforce single-instance execution. The malware decodes this string from Base64 at runtime to mimic a legitimate Windows Update KB identifier.
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
Detects malicious DLLs masquerading as libcurl.dll by identifying a low number of curl_easy_* exports combined with BRUSHLOGGER keylogger string artifacts. Designed to catch DLL side-loading attempts.
This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
Detects Sinobi Ransomware (suspected Lynx rebrand) payloads based on specific command-line arguments, help menu strings, ransom note URLs, and references to Curve-25519 and AES-128-CTR encryption routines.
Detects the Golang Sliver dropper or its associated opsec.log file. This malware leverages an LLM (GPT-4) to evaluate system telemetry before deploying its payload.
Detects log files or unpacked binaries associated with the .NET infostealer 'AI Theater' that uses ChatGPT for illusory evasion techniques. Identifies specific log markers such as LLM verification and evasion generation.
Detects the execution of INC ransomware utilizing specific command-line arguments (--sup, --hide, --mode medium) typically staged from the C:\perflogs\ directory. This pattern indicates active ransomware execution during the impact phase of an attack.
Detects potential APT10 (Stone Panda) activity by identifying the execution of known remote access tools (RATs) and suspicious use of utilities like WinRAR for password-protected archiving. The rule focuses on processes launched from non-standard directories and unusual parent processes, which may indicate malware execution, lateral movement, or data exfiltration.
MicroStealer Network IOCs
Cortex XDR
Detects network communication to known MicroStealer C2 domains or Discord webhook activity with a 'MicroStealer/1.0' user agent. This rule identifies potential MicroStealer malware activity within the network.
This rule detects the execution chain associated with MicroStealer, specifically looking for processes named 'RocobeSetup.exe', 'Game Launcher.exe', or 'miicrosoft.exe' that are involved in actions related to a file named 'soft.jar'. This indicates the potential presence and activity of the MicroStealer malware.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects network connections to known LLM/AI API endpoints from processes that are not standard web browsers. This is indicative of the LAMEHUG malware used by APT28, which leverages these APIs to dynamically generate and execute commands.
Page 164 of 232