Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
This YARA rule detects a specific Base64 decoding routine and associated hardcoded string patterns used by the Coyote Banking Trojan. The rule scans for bytecode sequences corresponding to .NET methods such as System.Text.Encoding::get_UTF8 and System.Convert::FromBase64String, which the malware uses to deobfuscate its malicious payloads or configuration components.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
day0 ToxicEyeRAT
YARA
These YARA rules detect the ToxicEye Remote Access Trojan (RAT), a malicious tool written in C# that leverages the Telegram Bot API for command and control. The rules identify specific hardcoded configuration settings (Telegram bot tokens, addresses for crypto wallets, persistence settings, and file grabber configurations), unique project strings (author attribution, warning messages), and debug logs associated with the malware's functional modules such as keylogging, credential stealing, file exfiltration, and system destructive capabilities like boot sector overwriting.
day1 CruLoader
YARA
This YARA rule detects the presence of the Cruloader malware by identifying specific embedded strings associated with its operation, such as custom character sets and internal identifiers, as well as unique code sequences characteristic of its cryptographic implementation.
Detects HTTP POST requests directed to the 'avenger-sync.live' domain by the PamStealer malware. The rule identifies specific C2 or exfiltration traffic patterns, including the '/api/sync' URI and a specific JSON-formatted data envelope in the request body, commonly used by the malware for communication.
Matches known Umbrij ConfuserEx-obfuscated .NET malicious DLL samples across three tool versions by full-file MD5 hash
This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects PamStealer's embedded helper binary dropped to /private/tmp/System Settings and used to establish legacy login item persistence via osascript System Events
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects high-volume file modification events resulting in files renamed with the .inc extension, which is a characteristic behavior of the INC ransomware strain. The rule monitors for more than 50 such modifications on a single host within a 10-minute window, serving as an indicator of active encryption and potential ransomware impact.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
This rule detects a correlation between an unauthorized IAM user access event and the subsequent execution of cryptocurrency mining tools within the same AWS account within a one-hour window. This is a strong indicator of an adversary leveraging compromised cloud credentials to perform resource hijacking.
Detects outbound network communication to ports 80 or 443 that lacks standard application-layer protocol signatures (HTTP/HTTPS/TLS). This behavior is characteristic of the Gh0stRAT malware, which uses a non-standard zlib-compressed protocol with a specific 'Gh0st' header, commonly observed in TA4922 operations.
Detects the PamStealer second-stage Rust-based arm64 Mach-O infostealer masquerading as Finder, identified by known SHA256 hash and embedded Rust toolchain build artifacts
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
Detects in-memory shellcode execution chains associated with BeepRAT and DcRAT. This includes the use of TCC (Tiny C Compiler) with specific flags for in-memory execution and LuaJIT FFI calls used to invoke Windows kernel functions (VirtualAlloc/CreateThread) for shellcode injection.
Page 66 of 232