Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects behavior consistent with the Vidar/Wingo loader, part of Operation Turb00, where a process probes for VM/sandbox artifacts, specifically the VMware Tools daemon path and WMI ETW restrictions registry keys, followed by a rapid process termination characteristic of sandbox evasion.
Detects the execution of ssh-add.exe from a Temp directory, which occurs as part of an attack chain involving a trojanized Franz Electron app. The process leverages DLL side-loading by loading malicious msys-crypto-3.dll, msys-2.0.dll, and msys-gcc_s-seh-1.dll, identified as components of the ResiLoader malware.
This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.
This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.
Detects in-memory DLL injection where a module is loaded into process memory without a backing file path on disk (action_module_path is null or empty). This technique, often referred to as reflective DLL injection, is used to evade detection. The rule further refines detection by flagging cases where the hosting process itself originates from an unusual or user-writable path, which can be indicative of DLL sideloading. This behavior is consistent with malware like Backdoor.Mistic or ModeloRAT, deployed by threat groups such as Woodgnat (KongTuke).
Detects execution of processes associated with Millenium RAT that contain specific strings indicating sandbox evasion techniques, including environment checks and stalling loops (Thread.Sleep/MemoryInfoDetector) used to bypass automated analysis.
Detects the presence of a specific global event object 'Global\ShitSetupOn26126k' used as a mutex or single-instance check by the DragonReturn malware dropper.
Detects outbound HTTP POST beaconing to known malicious C2 infrastructure (83.142.209.214) associated with the lambsys cryptominer campaign. The rule specifically looks for HTTP requests to /status.php or /setup_status.php utilizing the default Go HTTP client User-Agent, a common indicator of this specific malware.
Detects LCRYX ransomware behavior involving the creation of autorun.inf files on removable drives combined with the execution of VBScripts from removable media using wscript.exe, indicative of a worm propagating via USB devices.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects potential exploitation of CVE-2025-8088 involving WinRAR or unrar processing malicious archives with path traversal characters (../ or ..\). It identifies the extraction of script files (HTA, VBS, PS1, BAT) into the Windows Startup folder, followed by the execution of these files via mshta.exe or wscript.exe within a 30-second window, characteristic of Gamaredon group persistence mechanisms.
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.
Detects Pay2Key ransomware attempting sandbox evasion by executing the Windows timeout utility with a 10-second delay, initiated from the SysWOW64 command prompt.
Detects the execution of VILE ransomware by correlating the launch of the binary with the creation of specific artifacts used for system information discovery, specifically timezone-based geofencing and anti-analysis configurations.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
This rule monitors system activity for the presence of specific file names, paths, and image loads associated with known malware families, specifically BlueHammer, RedSun, UnDefend, Bluekit, and libpwn. The rule evaluates process creation, file creation, and DLL load events across EDR and endpoint logs to identify potentially malicious indicators.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
Detects LampoRAT malware based on known file hash execution.
Page 73 of 232