Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
This rule detects the installation or execution of known malicious, typosquatted npm packages associated with the SANDWORM_MODE campaign. It identifies process creation events related to common Node.js package managers (npm, yarn, npx) and checks for command lines indicating package installation or execution, specifically looking for the presence of malicious package names from the SANDWORM_MODE campaign.
Detects DKnife text markers and config file names referenced by Cisco Talos (dkimsi tag, default IMSI, credential tag, and common DKnife config artefact names).
Matches published GRIMBOLT/SLAYSTYLE/BRICKSTORM hashes from RecoverPoint VM intrusions.
Detects PowerShell launching RegSvcs.exe, a technique used by TA584 to deliver the 'P0WER' variant of XWorm via process hollowing. The 'P0WER' variant of XWorm uses a custom .NET loader that starts RegSvcs.exe in a suspended state, which is a strong indicator of process hollowing. Legitimate use of RegSvcs.exe by developers is possible but uncommon from PowerShell.
This rule helps you find files that may be connected to RESURGE activity affecting Ivanti Connect Secure devices, based on information shared by CISA. It can match in two ways: either the file has an exact fingerprint that CISA published, or the file contains a set of distinctive text clues that CISA included as part of its investigation material. A match should be treated as a strong lead that the device deserves immediate attention. First, confirm the match happened on an Ivanti appliance and not on a security tool repository or a harmless copy of the report. If it is on a live system, limit the device’s exposure, save copies of the matched files, and collect logs so you can understand when the change occurred and what else happened nearby. Use the result to prioritize triage and to guide deeper review of related files and activity on the same host.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
Detects web navigation to Amazon and AliExpress that contains specific hardcoded affiliate tags used by the 10xprofit extension network. The presence of these tags indicates active affiliate hijacking, likely due to a malicious browser extension.
Matches published CastleLoader stage hashes from ANY.RUN analysis.
Detects the execution of legitimate Windows executables from non-standard public directories. This is a technique used by the Dohdoor malware to sideload a malicious DLL (e.g., propsys.dll, batmeter.dll).
Detects execution of specific Python scripts (modes.py, extentions.py, udp.pyw) using the windowless Python interpreter (pythonw.exe) from user-writable locations. This behavior is a strong indicator of ModeloRAT delivered via the CrashFix/ClickFix campaign using portable WinPython for stealth.
This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
Keenadu Backdoor
YARA
Matches published Keenadu-related MD5 hashes from the report.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
This rule detects DYNOWIPER malware. It uses two primary detection methods: 1. Known SHA256 hashes of DYNOWIPER samples as published in a report. 2. A string-based detection logic derived from CERT Polska, as reproduced in the Elastic DYNOWIPER reporting. This logic looks for specific strings related to file paths, error messages, and Windows API calls, combined with a check for the 'SeShutdownPrivilege' string and a file size constraint, within a PE file (identified by the 'MZ' header).
This rule detects the execution or referencing of files named 'moonrise-client.exe', 'moonrise.exe', or 'moonriseclient.exe'. These filenames are associated with the Moonrise RAT, indicating potential malware activity on the system. The rule specifically looks for these filenames in the process's file name or command line arguments.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
Detects network connections to identified command and control (C2) infrastructure for both the original TrustConnect malware and its successor, DocConnect. This rule specifically looks for connections to known suspicious domains and IP addresses associated with these malware families.
Detects file creation or process execution events involving the SHA256 hashes of malicious DLLs from the NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ NuGet packages. This rule identifies the presence or execution of known malicious components associated with a supply chain compromise targeting ASP.NET developers.
Detects XWorm LATAM campaign artifacts via published SHA256 and unique network/mutex markers from ANY.RUN analysis.
Page 169 of 232