Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.
This rule detects the presence of XMRig cryptocurrency mining binaries, including those associated with the MayaBot campaign, by inspecting file contents for characteristic strings, configuration parameters, and executable signatures.
Detects a malicious DLL component associated with SynkLoader, identified by specific exported functions (RunPowerShell, ExecutePowerShellCommand) and assembly metadata that facilitate executing PowerShell commands directly in memory.
Detects the presence of known malicious files associated with the Dark Caracal LATAM campaign, including GoCaracal, Bandook RAT, and Delphi-loader payloads, based on specific SHA-256 file hashes.
Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.
SynkLoader PhishLocker Behavior
Cortex XDR
Detects indicators of the PhishLocker credential harvester, specifically the loading of fake Microsoft Visual C++ runtime DLLs from non-standard (user-writable) paths and unauthorized access to Windows lock screen images by Python-based processes.
Detects malicious DLL files attempting to masquerade as legitimate Microsoft Visual C++ runtime libraries (msvcp150.dll or msvcp160.dll) by identifying export markers and internal strings associated with the SynkLoader reflective PE loader.
Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.
Detects the use of a modified 'msvcp160.dll' associated with SynkLoader, specifically identifying exports related to manual DLL mapping ('ManualMapDLL', 'ManualResolveExport') and the accompanying Python loader script that utilizes 'ctypes.WinDLL' to perform in-memory execution.
Detects a universal (fat) Mach-O binary containing both x86_64 and arm64 architecture slices, within a specific file size range (500KB to 20MB). This signature matches the final-stage payload observed in the fake OpenAI Codex ClickFix campaign associated with the Atomic macOS Stealer (AMOS) malware.
Detects periodic execution cycles of ERAAgent.exe that involve memory protection changes, characteristic of the SLEEPWALKER malware's XOR-decrypt-execute-reencrypt loop scheduled by a cron-like mechanism.
Detection rule for a specific Rust-based Windows x64 backdoor known as C2Looper. The rule uses file hashes, debug strings, hardcoded configuration files/paths, and specific C2 API endpoints to identify the malware presence.
Detects the specific execution gate check utilized by WordlistLoader malware. The rule monitors ProcessApiCall events for OpenEventA or CreateEventA API calls using hardcoded, unique GUIDs known to be associated with this malware, ensuring high fidelity.
Detects WordlistLoader binaries containing the decode-and-execute routine that reconstructs shellcode via a wordlist mapping or UUID string array, then marks it RWX before invoking the entry point
Detects Amatera Stealer shellcode anti-emulation patching stub using cff_state control-flow flattening and inplace_xor_decrypt reflective loader routine
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
Detects Mirage2FA phishing stager artifacts by requiring multiple distinctive indicators together: XOR key 0xAD decode chain, LINX*/token placeholders, obfuscator.io _0x naming, api/xls C2 path, iframe injection, and SVG ECMAScript AiTM redirect
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
Detects TWINLOOT PyArmor 9.2.5-protected implant components via known file hashes combined with expected filesize range and filename/extension pattern (bootstrap-fat.pyc, pyarmor_runtime.pyd, .pyarmor.ikey, embedded vendor ZIP) to reduce false positives from renamed unrelated files with coincidental hash context
The following analytic detects a Windows Defender malware detection or remediation event where the scanned path resolves through the NT object manager namespace (\globalroot\).
It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity.
In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
It leverages Windows Defender Operational log EventCodes 1116 and 1117 to identify this activity.
In the ShieldBreak exploit, this is how Defender is coerced into hydrating a cloud file placeholder and copying attacker content through a symbolic link chain that ultimately writes into C:\Windows\System32.
If confirmed malicious, this activity indicates an attempt to weaponize Windows Defender's own scanning pipeline for local privilege escalation.
Detects the presence of the msaRAT MSI dropper (update_ms.msi) and its associated embedded payload (lib.dll), identified by the 'RUN' export and specific msa* string bindings used for inter-process communication or internal functionality.
Page 60 of 232