Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential malicious activity by monitoring for specific file hashes, specific suspicious filenames, and suspicious command-line patterns (e.g., 'antivm') initiated by known update or launcher processes. This is likely an indicator of malware behavior involving anti-sandbox or evasion techniques.
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects execution of a specific suspicious executable file masquerading in the Windows Temp directory, coupled with the access of an associated .ini configuration file. This behavior is indicative of AsyncRAT deployment, often involving initial execution or staging of configuration files within volatile user directories.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
Detects the execution of OrionQuests-Setup.exe, a .NET-based executable identified as a malicious installer used by the Kimsuky (APT-C-55/BabyShark) threat group. The rule flags PE files that match the specific filename and contain both .NET framework indicators and references to LNK files, suggesting the dropper mechanism for initial stage infection.
Detects instances where a process named firefox.exe is running from a non-standard location or includes keywords indicative of keylogging activity such as 'SetWindowsHookEx', 'GetAsyncKeyState', 'GetKeyState', or 'keylog'. This is a common behavioral indicator for the BabylonRAT malware.
This rule detects potential BabylonRAT malware samples by identifying a combination of dynamic API resolution techniques (using GetProcAddress and LoadLibrary) and XOR-obfuscated string blocks representing critical DLL and API names. The detection utilizes high file entropy and specific artifact strings to identify binaries attempting to evade static analysis.
Detects the presence of the modular C# backdoor framework known as Stella_Gary, used by the Kimsuky (APT-C-55) threat group. The rule identifies specific namespace and class strings associated with the framework within .NET executable files.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
Detects active phishing threat-intelligence indicators whose domain name uses one of the disposable TLDs observed across IronToll's 73+ rotating lookalike domains (.cfd, .sbs, .icu, .buzz, etc.). Scoped to the structured ThreatType classification only — dropped the free-text 'Description has phishing' fallback, since KQL's 'has' is a substring/token match with no negation awareness (e.g. a description stating an indicator is 'not related to phishing' would still match), which could pull in indicators unrelated to actual phishing activity.
Page 50 of 232