Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects known file hashes and filenames associated with the BRICKSTORM backdoor as reported by Google/Mandiant in relation to UNC5221 activity.
Detects the execution of a packet capture command with a specific buffer size known to be used by the LINE VIPER malware on Cisco ASA devices. LINE VIPER is a sophisticated malware designed to target Cisco ASA devices, often deployed by the RayInitiator bootkit.
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
Detects PhantomCard, an Android NFC-relay Trojan targeting banking customers in Brazil. It masquerades as a 'card protection' app and relays NFC data from the victim's card to the fraudster's device.
Detects the execution of various infostealers and RATs, such as BeaverTail, OtterCookie, WeaselStore, and AkdoorTea, used by the North Korea-aligned threat actor DeceptiveDevelopment.
Detects a high volume of file rename operations where files are appended with a randomized 16-character hexadecimal extension. This is a characteristic behavior of LockBit 5.0 ransomware during its encryption phase.
Detects potential LINE VIPER tasking activity via Cisco ASA WebVPN authentication requests. This involves looking for specific XML elements (<client-cert> or <client-cert-auth-signature>) containing large Base64-encoded data, which is indicative of embedded shellcode.
Yara rule that detects Veaty backdoor.
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
Detects LESLIELOADER, a Go-based malware loader used by the Chinese state-sponsored group RedNovember (TAG-100, Storm-2077) to deliver payloads such as SparkRAT and Cobalt Strike.
Detects loaders associated with RainyDay, Turian, and a new PlugX variant, used by threat actors like Naikon and BackdoorDiplomacy. The rule identifies the shared unpacking routine which uses a combination of RC4 decryption and LZNT1 decompression (via RtlDecompressBuffer), along with specific RC4 keys, PDB paths, and hardcoded payload filenames.
Detects files containing Command and Control (C2) domains and IP addresses associated with the 'Operation Rewrite' SEO poisoning campaign (CL-UNK-1037). These indicators are often found embedded in BadIIS malware variants or related configuration files.
Detects the managed .NET IIS module variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the PHP file handler variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects the creation of a PHP web shell file named 'hafuab.php' in '/usr/local/webui/' by an 'echo' command, which includes PHP code to display 'test - Open source project (github.com/test/test)' and 'phpinfo()'. This activity is indicative of an attacker attempting to establish persistent access and gain information about the web server environment.
Detects BadIIS malware variants associated with the 'Operation Rewrite' campaign (CL-UNK-1037). This rule identifies the native IIS module, PHP backdoors, and other related components used for SEO poisoning.
Detects the ASP.NET page handler (webshell) used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
Malicious NPM Package Version Download
Cortex XDR
This rule detects the download or installation of known malicious NPM package versions by monitoring process command-line arguments for specific package names and versions. It targets common package managers like npm, yarn, and pnpm, as well as node.exe, to identify instances where a compromised or intentionally malicious package is being introduced into a development or production environment.
Detects potential BlackLock ransomware activity where a process is launched with command-line arguments for network scanning and subsequently makes an SMB connection.
Page 189 of 232