Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the loading of the vulnerable RTCore64.sys driver. This driver is exploited by threats like kkRAT to disable AV/EDR security callbacks as part of a Bring Your Own Vulnerable Driver (BYOVD) attack.
This analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, or data exfiltration. It leverages process activity data from Endpoint Detection and Response (EDR) agents, focusing on known attacker tool names. This activity is significant because it serves as an early warning system for potential security incidents, enabling prompt response. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further network compromise, posing a severe threat to the organization's security infrastructure.
Yara rule that detects PondRAT backdoor.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
Detects potential DLL hijacking attempts used by DarkVision RAT for privilege escalation. The malware places a malicious 'DXGI.dll' in a non-standard path to be loaded by 'WinSAT.exe'.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
Detects a specific, outdated Internet Explorer user-agent string used by the UpCrypter malware for C2 communications. This User-Agent string is highly specific and outdated, making legitimate use extremely unlikely in modern environments.
No description available.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
Detects the execution of osascript with a command line that includes curl to download and execute a remote script, a technique used by the Odyssey Stealer malware.
Detects the execution of a malicious Linux payload, possibly within a .desktop file, a technique used by APT36. The rule identifies a bash process executing an inline command that downloads and runs a payload, often using a combination of curl, xxd, base64, and eval.
This rule detects the PathWiper trojan by identifying specific byte patterns associated with its functionality. The patterns indicate the malware's capabilities to find volumes, enumerate files, discover shared network drives, and overwrite files, which are characteristic behaviors of wiper malware.
This YARA rule detects the Pumakit rootkit on Linux systems. It identifies specific byte patterns associated with the rootkit's syscall hooking mechanisms, including patterns related to hooking `rmdir` and `gdents64` functions. The rule looks for these distinct code sequences within executable files to indicate the presence of the Pumakit rootkit.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
Detects the execution of an application from a mounted disk image (DMG) with a name known to be used by Odyssey Infostealer. This activity is indicative of initial access, where the user has been tricked into running a malicious application masquerading as a legitimate software installer or updater.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
The following analytic detects suspicious raw access reads to the device disk partition of a host machine. It leverages Sysmon EventCode 9 logs to identify processes attempting to read or write to the boot sector, excluding legitimate system processes. This activity is significant as it is commonly associated with destructive actions by adversaries, such as wiping, encrypting, or overwriting the boot sector, as seen in attacks involving malware like HermeticWiper. If confirmed malicious, this behavior could lead to severe impacts, including system inoperability, data loss, or compromised boot integrity.
The analytic detects the installation of a Linux kernel module using the `modprobe` utility. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.
This detection identifies the installation of developer-signed MSIX packages that lack Microsoft Store signatures. All malicious MSIX packages observed in recent threat campaigns (including those from FIN7, Zloader/Storm-0569, and FakeBat/Storm-1113) were developer-signed rather than Microsoft Store signed. Microsoft Store apps have specific publisher IDs containing '8wekyb3d8bbwe' or 'cw5n1h2txyewy', while developer-signed packages lack these identifiers. This detection focuses on EventID 855 from the Microsoft-Windows-AppXDeployment-Server/Operational logs, which indicates a completed package installation.
Page 191 of 232