Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the presence of PHP web shell code within the Admin Menu Editor Pro WordPress plugin directory. This rule targets indicators of a supply chain compromise where a legitimate plugin update is backdoored to include malicious PHP code designed for remote command execution via HTTP requests.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Matches known Phantom Stealer MaaS infostealer sample hashes
Matches known Phantom Stealer MaaS infostealer sample hashes
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Matches known SilverFox malware payload samples by SHA256 hash
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Detects executable files containing XOR-obfuscated strings associated with BabylonRAT capabilities, including browser credential theft, keylogging, HOSTS file manipulation, DDoS, and remote dynamic API resolution. This rule identifies patterns commonly used to evade static analysis.
This rule detects the execution of the HTSPnew.Exe ransomware payload, associated with a trojanized HTS DLL, and subsequent ransomware-related file operations, such as the creation of .krsid encrypted files and the dropping of a Korean-language ransom note (README_KRSID.Txt).
This rule detects HTTP traffic patterns consistent with a Golang-based Remote Access Trojan (RAT) beaconing to a command and control (C2) server. It monitors for specific fitness-themed URI paths used for C2 communication and identifies the use of a hardcoded domain ('monitorondomainwintgt') within both the HTTP Host header and the TLS SNI field.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
Detects malicious LNK files associated with the Transparent Tribe (APT36) campaign, which are designed to execute concealed batch scripts (e.g., doxc.bat, config.bat) via cmd.exe. These files are typically disguised as documents (resumes, details) to facilitate the deployment of secondary payloads like CrimsonRAT.
This rule detects network traffic patterns associated with the PSNATCH malware exfiltrating data to GitHub. It specifically identifies HTTP requests to 'api.github.com' using the custom 'SmartUploader' User-Agent string, which is characteristic of this malware's exfiltration behavior.
Detects network activity associated with the RUSTYSHADE malware, specifically identifying the 'HCENC1:' prefix used in HTTP requests to encapsulate AES-256-GCM encrypted command and control traffic directed towards GitHub API channels.
Detects potential CrimsonRAT backdoor binaries on Windows systems by identifying characteristic obfuscated ASISFH command tokens, embedded C2 infrastructure strings, and specific dropper file artifacts associated with Transparent Tribe (APT36).
Detects a Golang-based remote access trojan (RAT) attributed to the Transparent Tribe (APT36) threat group. The rule identifies the malware based on distinctive fitness-themed C2 API endpoints, specific function names, hardcoded authentication secrets, and embedded Go runtime markers, while also monitoring for associated persistence registry keys and file paths.
Detects the KRSID Rust-based ransomware binary by matching against known file hashes or by identifying specific command-line arguments and embedded file/log indicators commonly used by the malware.
Detects ISO or ZIP archive files containing a specific combination of a LNK file named 'My Resume.pdf.lnk' and a 'doxc' directory. This specific file structure is associated with Transparent Tribe (APT36) activity used to deliver malicious payloads via social engineering lures.
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
Page 46 of 232