Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects activity related to the Chrysalis Backdoor, which is associated with the Lotus Blossom threat group. It identifies malicious activity through three main components: 1. File and process events matching a list of known malicious SHA256 hashes. 2. Network connections to known malicious IP addresses or domains. 3. Suspicious execution of 'svchost.exe' from non-standard Windows directories with specific command-line arguments, indicating potential masquerading or malicious execution.
Detects the creation of a 'startup.js' file in specific, non-standard subdirectories used by the Lazarus Group's 'Graphalgo' campaign to stage malicious payloads. These paths mimic legitimate application folders to evade detection.
Detects the creation of a JavaScript file in unusual subdirectories of the Google Chrome user data or application support folders. This behavior was observed in the 'graphalgo' campaign by the Lazarus Group to stage second-stage payloads.
ET TROJAN Microsoft ClickFix IOC IP
Detects a sequence of HTTP requests where the User-Agent shifts from 'WordPressAgent' to 'FingerPrint' within a short time window, a behavior associated with OysterLoader C2 registration and payload retrieval.
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
Detects obfuscated PowerShell downloading 'script.ps1' from a suspected CrashFix C2 server (69.67.173.30) by identifying specific obfuscation patterns and download-related keywords in the PowerShell command line.
Detects the execution of specific Python scripts (modes.py, extentions.py, or udp.pyw) using the silent pythonw.exe interpreter. This activity is associated with the ModeloRAT malware, which is used in the CrashFix campaign, indicating potential persistence or execution of malicious payloads.
Detects the VoidLink malware's initial dropper behavior, where a process masquerading as a kernel thread executes a payload from memory. This is indicative of the memfd_create and execveat fileless execution technique used by VoidLink, characterized by a process created with no FolderPath or FileName, initiated by a process named like a kernel thread.
Detects known malicious file hashes associated with the Clawdbot VS Code extension malware. This includes the weaponized ScreenConnect installer (Code.exe) and the Rust-based loader (DWrite.dll).
Detects the execution of Python scripts associated with the ModeloRAT, such as modes.py, extentions.py, or udp.pyw. This activity is part of the CrashFix campaign, where attackers deploy a portable Python environment to ensure payload execution.
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects network connections to known Command and Control (C2) infrastructure (domain or IP) associated with the Chrysalis backdoor, used in the Notepad++ supply chain attack.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
Detects DLL side-loading activity associated with the Silver Fox APT, where the legitimate Thunder.exe application is executed from a temporary directory to load a malicious, unsigned libexpat.dll.
This rule detects network connections to domains known to host and distribute malicious file converter applications that install Remote Access Trojans (RATs).
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
Detects the creation of files with an imphash associated with UKC-1230 (Comburglar) malware. This imphash is a high-fidelity indicator for the surrogate DLLs used in their COM hijacking persistence technique.
Page 172 of 232