Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution of Mimikatz for credential dumping shortly after the WDigest 'UseLogonCredential' registry key is enabled. This combination of TTPs is associated with the Qilin ransomware group.
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
Detects a malicious PDF dropper that uses specific objects and patterns indicative of malware activity.
Detects ransom note creation associated with Yurei ransomware.
Detects execution of BADAUDIO malware downloader used by APT24
Detects a PowerShell process that makes an outbound network connection and contains command-line arguments associated with reflectively loading a .NET assembly from a Base64 encoded string. This is a common fileless technique used by malware like Remcos to execute payloads in memory.
Detects known malicious file hashes associated with the VoidLink malware framework.
Detects the DLL sideloading of the Kazuar v3 loader (hpbprndiLOC.dll) by a legitimate Hewlett-Packard printer driver installer (hpbprndi.exe). This technique is used by Turla to initiate its infection chain.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
Detects MuddyWater Rust-based implants containing unstripped build artifacts, specifically the username 'Jacob' and other development environment paths.
Detects a sequence of events associated with the Astaroth banking trojan, where a script downloads a file from a raw GitHub URL, followed by the execution of an AutoIT interpreter. Astaroth is known to use GitHub to host configuration files disguised as images (steganography).
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
Detects the presence of specific Chrome, Edge, or Firefox browser extension IDs associated with the DarkSpectre Zoom Stealer malware. This rule aims to identify compromised systems exhibiting the installation artifacts of the malicious browser extensions.
This KQL look for any IOCs from the given list and compare against EmailEvents on Defender for Email
This detection identifies outbound network traffic to domains, IP addresses, or a specific port known to be associated with the PHALT#BLYX campaign's infrastructure. The campaign uses these for malware delivery and DCRat command and control (C2). The rule specifically looks for connections to known malicious IPs or domains, or connections on port 3535 (used by DCRat) originating from processes associated with the malware (staxs.exe, tybd7.exe, aspnet_compiler.exe).
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
SleepyDuck Malware Etherhiding
Cortex XDR
This rule detects network connections to specific RPC addresses and a contract address associated with the SleepyDuck malware's Etherhiding technique. It filters for DNS queries containing known RPC domains and HTTP/network activity containing a specific Ethereum contract address. This indicates potential communication with the malware's command and control infrastructure for persistence.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
Page 175 of 232