Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the DUPERUNNER implant injecting shellcode into common legitimate Windows processes like explorer.exe, notepad.exe, or msedge.exe. This behavior is associated with the UNG0902 threat actor as part of the Operation DupeHike campaign.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects host-based artifacts associated with AK47/X2ANYLOCK ransomware, such as the creation of specific ransom notes ('How to decrypt my data.txt', 'How to decrypt my data.log') or files being encrypted with the '.x2anylock' extension. This rule identifies both the creation of the ransom note and the encryption of files by monitoring file creation and renaming events.
Detects the download of a Java Archive (JAR) file initiated by a PDF reader or web browser, specifically from devices located in Uzbekistan. This behavior is characteristic of the Bloody Wolf threat actor's geofenced attacks.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects the execution of mshta.exe with a URL containing a hex-encoded second octet in an IP address. This is a specific pattern observed in the initial access stage of the ClickFix malware campaign.
Detects the RomCom loader 'msedge.dll' being loaded from a location outside of the legitimate Microsoft Edge installation directory. This is a known TTP for the RomCom threat group to load their Mythic Agent, often as a result of COM hijacking.
This detection identifies Command and Control (C2) communication associated with the FormBook RAT, specifically targeting connections to a known malicious IP address and dynamic DNS domain on an unusual port. Detecting C2 activity is crucial for identifying active compromises and preventing data exfiltration or further malicious commands.
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects the presence of old versions of NetSupport Manager (client32.exe), a tool repurposed as a RAT by the Bloody Wolf threat actor. The actor is known to use versions from October 2013 or older. This rule specifically looks for 'client32.exe' with the file description 'NetSupport Client' and a FileVersion older than '12.0.0.0'.
Detects the creation of image files on endpoints that match the characteristics of the LANDFALL Android spyware delivery mechanism. LANDFALL is delivered via malformed DNG/JPEG files, often through WhatsApp. This activity could represent a user downloading or staging the malicious file on a corporate endpoint before transferring it to a mobile device. The rule looks for specific filename patterns associated with WhatsApp and known malicious file hashes.
Detects network connections from Samsung Android devices that match the Command and Control (C2) patterns of the LANDFALL spyware. The rule identifies high-fidelity connections to known LANDFALL C2 IPs and domains, as well as lower-fidelity behavioral patterns, such as connections over HTTPS to non-standard ports.
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
Detects known malicious files associated with the LANDFALL Android spyware by their SHA256 hash. This provides a high-fidelity method for identifying the presence of the spyware on an endpoint.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Detects outbound network connections from common messaging or gallery apps on Samsung Android devices to command and control (C2) infrastructure associated with the LANDFALL spyware.
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
Page 179 of 232