Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the presence of malicious Chrome extensions associated with the 10xprofit affiliate hijacking campaign. These extensions are installed as folders with the extension ID as the name in the user's browser profile directory. The rule identifies file events in common browser extension paths for Chrome and Edge, extracts the extension ID, and checks if it matches a known list of malicious IDs.
Detects the execution of AutoIt3.exe (or renamed versions) from non-standard paths or with suspicious script extensions, which is indicative of CastleLoader activity. This rule specifically looks for AutoIt interpreter execution, including renamed files with .pif or .com extensions, originating from common temporary or user-writable directories like AppData or Temp, and executing suspicious script file extensions such as .a3x, .t, or .vstm, or very short command lines.
Detects a Node.js process making outbound network connections to known malicious infrastructure associated with a developer-targeting campaign. The campaign used Vercel for staging and specific IPs for C2.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
Detects a high volume of file renaming operations to the '.ENCRT' extension, combined with the creation of the 'R3ADM3.txt' ransom note by the same process. This behavior is characteristic of the Gunra ransomware encryption routine.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
Detects the creation of files with a 64-character hexadecimal filename followed by a '.keystore' extension. This is a unique artifact of the Gunra ransomware's 'separate keystore' mode used for storing encryption keys.
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
This rule detects various stages of the CastleLoader malware activity, including C2 communication, process hollowing using AutoIt and jsc.exe, and known malware hashes. It correlates network traffic to a specific C2 server, identifies suspicious process creation patterns where AutoIt launches jsc.exe, and sweeps for known SHA256 hashes associated with CastleLoader.
This rule detects indicators associated with the RenEngine campaign, which involves the deployment of HijackLoader, Lumma Stealer, and ACR Stealer. Detection is based on specific MD5 hashes of known malicious files, filenames used in the campaign, and command and control (C2) domains identified as part of the infrastructure.
Detects the presence of files matching the SHA256 hashes of known RESURGE malware components, including the main 'libdsupgrade.so' library, the 'liblogblock.so' log tamperer, and the 'dsmain' utility. This rule identifies the creation or modification of these specific files on a device.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
This rule detects the installation of known malicious browser extensions associated with the ChatGPT Stealer campaign. These extensions are designed to steal AI session tokens and conversation data by monitoring file creation or renaming events in directories where browser extensions are typically installed.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
Detects the MSHTA utility (mshta.exe) executing a remote script which then spawns a .NET registration utility (RegAsm.exe or RegSvcs.exe). This specific execution chain is a high-confidence indicator of malware loaders like XWorm and Lumma Stealer, often delivered via ClickFix social engineering lures.
This rule detects artifacts associated with the RenEngine, HijackLoader, and Lumma campaigns. It identifies these threats through a combination of specific MD5 hashes, high-signal domain markers (both distribution and C2 domains), and unique filenames. The rule triggers if a file's MD5 hash matches one of the known malicious hashes, or if it contains at least one specific filename in conjunction with at least one domain marker, or if it contains at least two distinct domain markers (either distribution or C2).
This rule detects activity associated with the RenEngine campaign, which utilizes HijackLoader to deliver Lumma Stealer and ACR Stealer. It identifies malicious activity through three main methods: 1) Endpoint detection of known MD5 hashes associated with the malware, 2) Network traffic (proxy/DNS/netflow) to distribution sites used by the campaign, and 3) Network traffic (proxy/DNS/netflow) to known Lumma Stealer C2 domains.
Detects processes associated with Dohdoor malware making network connections to Cloudflare's DNS-over-HTTPS service for C2 domain resolution.
Page 168 of 232