Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution or presence of the TOKYOCORE ransomware binary by matching its known MD5 and SHA256 file hashes, or by identifying the specific filename 'fsociety.exe'.
This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.
This rule detects HTTP response bodies containing indicators associated with SourTrade malvertising campaigns, specifically JSON configuration fields and a base64-encoded Windows PE executable header (MZ/TVqQAAMAAAAEAAAA).
Detects TOKYOCORE ransomware via high-confidence identity strings; a single match is sufficient
This rule detects potential ransomware activity by monitoring for specific PowerShell commands associated with file encryption (AES, CreateEncryptor, TransformFinalBlock) and suspicious file manipulation patterns, such as mass renaming of files with common ransomware extensions or the dropping of known ransom note filenames.
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.
Detects Mach-O ARM64 payloads disguised as legitimate macOS system utilities (CamDriverUpdate.app camera driver updater, Chrome.MediaPatcher) used in the BlueNoroff ClickFix campaign
Detects PE files from the TAG-195 TinyEgg/ChonkyChicken/ChromEggscalator MaaS family via co-occurrence of distinctive embedded command markers, debug flags, and log path strings, requiring at least two markers to reduce false positives from individually generic strings
Exact SHA256 match against the two known malicious mrmustard 0.7.4 PyPI sdist/wheel artifacts. Uses full-file (0, filesize) SHA256 equality only, not partial or truncated comparison.
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Detects TOKYOCORE via overlap of data-theft artifact strings and persistence-mechanism strings (Tier 4 cluster)
Tier 5 catch-all: flags files exhibiting a broad spread of TOKYOCORE-related strings across identity, C2, ransom-note/branding, destructive, file-operation, data-theft, and persistence clusters, regardless of which specific cluster dominates
Detects AzureCommunication.dll C2 communication module by embedded strings or known hashes
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
YARA signature for the MSI installer's spoofed property data impersonating a legitimate Windows update package, requiring both the spoofed filename and an MSI-internal structural artifact
YARA signature for the msaRAT DLL requiring all embedded msaOpen/msaClose/msaError/msaMessage/dataAck binding names and Tokio/Rust runtime strings to co-occur in a valid PE/DLL
This rule monitors for the execution of a process with a specific SHA1/MD5 file hash known to be malicious. This is a high-fidelity detection strategy for blocking or alerting on specific threats already identified as malicious in threat intelligence.
Page 63 of 232