Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This analytic detects the creation of specific archived files, 'passff.tar' and 'cookie.tar', which are known indicators of IcedID malware exfiltrating sensitive browser information like history and cookies. The detection leverages Sysmon EventCode 11 to identify these file creations. This activity is critical as it signifies the potential compromise of sensitive user data, which could lead to further exploitation, data breaches, or escalation of attacker presence within the network.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This YARA rule detects the Veaty backdoor by identifying specific bytecode patterns related to fetching commands, reading mailbox folders, and adding inbox rules. The rule looks for a combination of these patterns within a file that also has a valid MS-DOS executable header (MZ header).
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
Detects the creation of batch (.bat) files within the Windows Startup folder, a common persistence mechanism. The rule prioritizes detection of files matching known malicious patterns, specifically 'HealthApp-*.bat' associated with the SORVEPOTEL malware, and flags other generic batch file creations in the Startup folder for investigation.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
Detects DLL side-loading activity consistent with the Mustang Panda Claimloader malware. This rule looks for a process loading a DLL from its own directory, a common side-loading pattern. It specifically targets IOCs from the Claimloader campaign (e.g., decoy executable metadata and malicious DLL names) or a more generic pattern where an executable in a suspicious location loads a DLL.
This analytic identifies instances where executable files (.exe) are loaded as modules, detected through 'ImageLoaded' events in Sysmon logs. This method leverages Sysmon EventCode 7 to track unusual module loading behavior, which is significant as it deviates from the norm of loading .dll files. This activity is crucial for SOC monitoring because it can indicate the presence of malware like NjRAT, which uses this technique to load malicious modules. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, maintain persistence, and further compromise the host system.
Detects Chaos C++ ransomware payloads based on known file hashes and unique embedded strings from the malware.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects the creation of files with names used by Yurei ransomware to masquerade as legitimate system processes or backups in unusual locations.
Detects components of the NET-STAR malware suite, including IIServerCore and AssemblyExecuter, used by the Chinese-nexus APT group Phantom Taurus.
Detects a high volume of process and service terminations using 'taskkill.exe' and 'sc.exe' within a short time frame. This behavior is characteristic of ransomware like FunkLocker, which aggressively disables applications and services to prepare for encryption.
Detects the FlipSwitch Proof-of-Concept (PoC) Linux rootkit. This rootkit is designed to bypass modern Linux kernel (v6.9+) defenses by patching call instructions within the x64_sys_call function, a technique dubbed 'FlipSwitch'.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Yara rule that detects BPFDoor backdoor.
Page 188 of 232