Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution of concatenated commands via "cmd.exe" that are characteristic of Pikabot malware. Pikabot often uses "cmd /c" to combine commands like "curl" or "wget" for downloading payloads, "ping" and "timeout" for delays, and "Rundll32" for executing malicious DLLs. The rule specifically looks for the combination of these commands, indicating potential Pikabot infection.
Detects malicious ASP.NET webshell activity associated with the CL0P Ransomware Gang exploiting CVE-2023-34362. The rule looks for specific HTTP headers used by the webshell, indicators of Azure Blob Storage interaction, or SQL injection attempts.
Detects the DLL side-loading of 'jli.dll' by 'keytool.exe' from common malware staging directories. This is a more generic version of a rule detecting a technique used by ValleyRAT in Operation Silk Lure.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
Detects HTTP requests indicative of Oyster malware C2 beaconing, including GET requests to /reg with WordPressAgent User-Agent and application/json Content-Type, GET requests to /login with FingerPrint User-Agent, and GET/POST requests to /api/kcehc or POST requests to /api/jgfnsfnuefcnegfnehjbfncejfh.
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.
This rule detects the Cruloader malware based on specific strings found within its binaries. The first rule, 'Loader_Cruloader_Strings', identifies the malware by looking for an RC4 key, a ROT13 charset, and the string "cruloader" itself. The second rule, 'Loader_Cruloader_Crypto', identifies the malware by looking for specific byte patterns indicative of its cryptographic routines, likely related to its RC4 implementation.
These rules detect encrypted ZIP files that contain only a single entry. The rules further specialize to detect if that single entry is a VBScript (.vbs) or Microsoft Management Console (.msc) file. This pattern is often used by adversaries to deliver malicious payloads, bypassing email security solutions that might not scan encrypted archives or might not recognize the malicious intent of single-entry archives containing specific script or configuration file types.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects the presence of source code files associated with the Suterusu Rootkit. It looks for specific function definitions ('hijack_start', 'hijack_pause', 'hijack_resume', 'hijack_stop') typically found in 'common.h', print strings related to rootkit functionality ('Dropping to root shell', 'Hiding TCPv4 port %hu', 'Unhiding TCPv6 port %hu', 'Enabling module loading', 'Silently prohibiting module loading') from 'sock.c', and a define statement ('#define SUTERUSU_INIT_WORK') from 'dlexec.c'. The rule triggers if at least three of the function definitions are found, or any of the print strings, or the define statement.
Detects a specific command line argument being passed to a binary, which has been observed in use by the Small Sieve malware. The rule specifically looks for command lines ending with '.exe Platypus'.
This rule detects macOS malware associated with the North Korean threat actor group CitrineSleet (also known as AppleJeus or UNK_JuiceHead). It specifically identifies binaries that exhibit consistent Dylib and Entitlement usage patterns observed in variants like UpdateAgent, SimpleTea (aka POOLRAT), and CrashReporter. The detection is based on matching specific hashes for the dylib and entitlement sections within Mach-O executable files.
This rule detects a suspicious activity chain where an SVG file is created by Outlook, immediately followed by a browser downloading a potentially malicious payload (archive, executable, or script file) on the same device within a short timeframe. This pattern could indicate a social engineering attack where a user is tricked into opening a malicious SVG attachment, which then leads to the download of a secondary malicious file.
This rule detects the SugarWraith loader DLL, which is associated with the UNK_SweetSpector threat group. It identifies the malware based on a combination of specific strings found within the binary, including error messages related to process and pipe creation, system information gathering strings, and network-related strings like "ngrok-skip-browser-warning" and "SecureProtocols". The presence of at least four of these strings indicates the potential presence of the SugarWraith loader.
This rule detects the Amos Stealer malware by identifying specific dylib and entitlement hashes within Mach-O files. It targets macOS executables that exhibit these unique characteristics associated with the Amos Stealer.
Detects execution of ChromeLoader malware via a registered scheduled task, specifically looking for PowerShell executing Chrome with a `--load-extension` argument pointing to a suspicious local path.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
Page 186 of 232