Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
Detects the execution or presence of the EKZ Stealer binary by its known SHA-256 hash. EKZ Stealer is an infostealer malware that utilizes techniques like control-flow flattening and opaque predicates to evade static analysis and decompilation.
This rule detects the execution of processes named 'RoguePlanet.exe' and monitors for inter-process communication using named pipes with the same name. This pattern is indicative of a specific malware payload attempting to establish communication channels for C2 or process interaction.
This rule detects unauthorized exfiltration of stolen browser and credential data by the Yuta/Glove Stealer malware (winupdate.exe). It identifies outbound HTTPS network connections from the specific indicator file path '%APPDATA%\.cache\winupdate.exe' to known C2 endpoints, including Discord webhooks, Telegram bot APIs, or connections utilizing the 'python-requests' user agent.
This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
Detects disguised malicious files, typically mimicking XML or MAP documents, that contain multiple PNG IDAT chunk markers but lack a valid PNG header and XML declaration. This signature is consistent with the HijackLoader staging technique, where XOR-encrypted and LZNT1-compressed data is hidden within the structure of spoofed file formats.
Detects Cavern Agent trojanized uxtheme.dll that hides real payload logic behind the EnableThemeDialogTexture export (ordinal #20) among 82 inert stub exports
Detects Android APK files that contain a combination of suspicious permissions and features often used for credential harvesting, specifically the binding of an accessibility service, SMS interception permissions, and overlay capability (System Alert Window).
Detects suspicious processes, such as those masquerading as legitimate system files or identified malware, accessing the webcam capability through the Windows CapabilityAccessManager consent store. This activity is often associated with remote surveillance commands initiated by RATs.
IoT botnet malware family used for DDoS and proxy infrastructure
Detects the Yuta .NET WPF dropper (SLaunch.exe) executing and subsequently creating a secondary payload (winupdate.exe) within the AppData\Roaming\.cache directory. This pattern is characteristic of the Yuta/Glove Stealer infection chain where a dropper masquerading as a UI component stages a PyInstaller-compiled stealer binary.
Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects network connections to specific IP addresses and ports (1259, 1269) via UDP, or the presence of a file with a specific SHA256 hash. This combination could indicate command and control (C2) communication or data exfiltration using a custom UDP protocol.
Page 67 of 232