Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects processes where an executable file (.exe) attempts to masquerade as a common document, image, or archive file type by including extensions like .pdf, .doc, .zip, .jpg, etc., within its filename, followed by the .exe extension. It specifically excludes executables originating from Microsoft Office root directories to reduce false positives.
Detects the execution of a Python stager associated with OmniStealer. The stager uses an inline command to decompress and execute the final payload, a common technique for this malware family.
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
This rule detects artifacts associated with the Havoc loader, specifically targeting a fake tech support scam. It looks for combinations of strings related to Adobe ARM staging, a 'license.key' file, and specific DLL names like 'vcruntime140_2.dll' and 'mpclient2.dll', which are indicative of the loader's operation and DLL sideloading techniques. The rule also includes a specific byte sequence ($a1) that may be a unique identifier for the Havoc loader.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
This rule set detects components of the ClipXDaemon, a Linux clipboard hijacker. The first rule, 'ClipXDaemon_Bincrypter_Loader', identifies a loader component characterized by specific strings related to process information, OpenSSL, gzip, and a pattern of variables (P, S, C, R) often used in shell scripts for unpacking, all within a small file size. The second rule, 'ClipXDaemon_ELF_Clipboard', targets the main ELF executable of ClipXDaemon. It looks for an ELF file that interacts with X11 clipboard functions (XConvertSelection, XSetSelectionOwner), attempts to masquerade its process name as 'kworker/0:2-events', and contains hardcoded cryptocurrency wallet addresses used by the attacker. Together, these rules aim to identify both the unpacking mechanism and the core functionality of the ClipXDaemon malware, which is designed to swap cryptocurrency wallet addresses from the clipboard.
This rule detects files associated with two distinct malware chains, ShellFolder and LOTUSLITE, which have been observed in campaigns leveraging Middle East conflict themes as bait. The ShellFolder chain detection focuses on specific file names like 'ShellFolder.exe', 'ShellFolderDepend.dll', and 'BaiNetdisk', along with a unique decryption key '20260301@@@'. The LOTUSLITE downloader chain detection identifies specific DLLs ('libmemobook.dll', 'kugou.dll'), folder paths ('C:\ProgramData\CClipboardCm\', 'C:\ProgramData\WebFeatures\'), executable names ('WebFeatures.exe'), and hardcoded URLs/IP addresses ('www.e-kflower.com', '172.81.60.97') used for persistence and downloading next-stage malware. The rule aims to identify concrete indicators of compromise rather than broad patterns, focusing on the specific artifacts reported in related threat intelligence.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
Detects HTTP requests to download the BoryptGrab stealer, which uses a specific URL pattern containing a hardcoded build name. This activity is characteristic of the initial launchers used in the BoryptGrab campaign to fetch the main stealer component from a C2 server.
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
Detects the creation of files with the '.waiting' or '.wait' extension, which are appended by Crytox ransomware to encrypted files. This rule specifically looks for file creation events where the filename ends with these characteristic extensions, indicating potential ransomware activity.
Detects trojanized cron binaries that hide malicious cron jobs, with indicators resembling Perfctl
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
This rule detects the presence of specific file hashes associated with the TrustConnect campaign on devices. It directly identifies known malicious lure files by their SHA256 hash, providing a narrow and high-confidence detection for triage and initial checks.
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Page 166 of 232