Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Detects activity associated with the TA4922 (Silver Fox) threat actor, specifically involving Atlas RAT and RomulusLoader. The detection logic utilizes four primary telemetry sources: network connections to known C2 IP addresses, DNS queries for the 'srt.tw' domain, suspicious outbound connections from user-writable directories (AppData, Temp, etc.) over non-standard ports, and the execution of a specific malicious ZIP archive file identified by its SHA256 hash.
Detects a suspicious execution chain where a dropper (chrome_setup.exe) uses an AppDomainManager injection technique to load a malicious DLL, followed by the execution of the TinyRCT payload (PerfWatson2.exe) from the LocalAppData directory. This behavior has been observed in campaigns targeting Southeast Asian government and critical infrastructure.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects suspicious file renaming activities indicative of ransomware. It specifically looks for files that previously had common document extensions (.doc, .xls, .ppt) being renamed to extensions commonly associated with encryption by ransomware (.encrypted, .locked, .crypted, .ecc). The rule triggers if 20 or more such renames occur within a 5-minute window on a single device.
This rule detects attempts by a device to resolve specific domain names known to be associated with ransomware killswitches. Successful resolution of these domains could indicate a ransomware infection attempting to halt its encryption process.
Detects network activity initiated by the TukTuk malware to communicate with Arweave public gateways (arweave.net and g8way.io), which are utilized as dead-drop resolvers for C2 infrastructure resolution.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects suspicious browser-downloaded executables using image, screenshot, document, invoice, scan, or receipt-themed filenames that execute from user-writable locations and are followed by suspicious payload creation, Run-key persistence, or outbound network activity. This behavior is commonly associated with malware loaders, fake image/document lures, and user-executed initial access payloads.
Detects the transmission of a Metasploit Meterpreter stage over HTTP, identified by an application/octet-stream response containing the DOS MZ header signature.
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
Detects indicators of the KuinaExtractor infostealer, including specific named pipes/objects, the creation of a 'zenith_debug.txt' file in user profile directories, and the presence of build-related aliases ('kuina1999', 'k0to') in process command lines or file paths.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
Detects a fileless execution technique used by the MYRA Linux RAT where a payload is executed from memory using memfd_create and fexecve, effectively bypassing disk-based detection. The rule identifies processes originating from Node.js or npm installation scripts that exhibit anonymous, memory-backed execution paths typical of this malware's lifecycle.
Detects common suspicious child processes spawned by identified Remcos RAT binaries (remcos.exe or remcos_all_enabled_watchdog.exe). This rule monitors for potentially malicious process execution patterns, such as command shell abuse or unauthorized system tool usage, which are indicative of post-exploitation activity by the Remcos Remote Access Trojan.
This rule detects an unusually high volume of file deletion events on a device within a short time frame (100 or more files deleted within a 5-minute window). This activity can be indicative of malicious behaviors such as ransomware encrypting and deleting original files, data wiping attacks, or an adversary attempting to remove forensic evidence by deleting logs or other critical files.
This rule detects the presence of known LokiBot packed binaries by matching the SHA256 hashes of staged memory section bins that were recovered during unpacking analysis. This indicates a high-confidence match for known malicious samples associated with the LokiBot information stealer.
Page 72 of 232