Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
Detects PowerShell executing Base64-encoded commands, often used by malware like Potemkin Loader (ClickFix payload), to evade basic string matching. The detection specifically looks for PowerShell processes initiated by explorer.exe with a command line containing a Base64-encoded string.
Loader used in click-hijacking traffic distribution scheme
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects the Yuta/Glove stealer malware (winupdate.exe) communicating with Discord webhooks or API endpoints. This behavior is indicative of data exfiltration or receipt of interactive RAT commands, such as shell, webcam, keylogger, and system tracing.
Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
Detects HTTP GET requests to a specific file path (docs.zip) on the Ukrainian government website (drs.gov.ua), identified as an activity associated with the Turla threat group's STOCKSTAY malware component.
Detects outbound HTTP POST requests with specific URI patterns (/rob/ or /ins/) that are indicative of TrickBot malware command and control (C2) check-in activity.
Detects HTTP traffic patterns characteristic of Emotet malware command and control (C2) beaconing, specifically looking for POST requests with random alphanumeric URIs (4-16 characters) and a specific Accept-Encoding header (gzip, deflate).
Detects continuous command and control (C2) beaconing activity from Remote Monitoring and Management (RMM) tools over non-standard high ports. This rule identifies RMM processes (rmm, agent, client*.exe) establishing frequent network connections to remote IPs on ports greater than 1024, excluding common ports like 3389 (RDP), 8080, and 8443, indicating potential malicious use of RMM software for C2.
Detects the execution of child processes (mshta, cmd, powershell, wscript, cscript) spawned by Microsoft Word (winword.exe), which is a common post-exploitation pattern for Remcos RAT delivered via malicious RTF documents utilizing CVE-2017-0199 remote template injection.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Detects PE files exhibiting behavior consistent with LokiBot malware, specifically the use of a custom CRC32-variant hash function with a XOR polynomial of 0x4358AD54 for runtime API resolution. This technique is used to evade static import analysis by resolving Windows APIs dynamically via hashed identifiers.
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
Detects the Bumblebee loader by identifying a hardcoded list of CIS-region locale strings within the file, used in conjunction with 'GetSystemDefaultLocaleName' and 'ExitProcess' to perform an anti-analysis kill switch, terminating execution if the infected system is located in a Commonwealth of Independent States (CIS) region.
Detects the initialization phase of the Operation DragonReturn DcRAT loader, specifically identifying the creation of a unique named global mutex (Global\ShitSetupOn26126k) which acts as a single-instance enforcement mechanism and is often associated with sandbox evasion techniques.
Page 68 of 232