Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
This rule detects the creation of a new Windows service (EventID 7045) where the service executable path contains both 'System32' and 'svchost', and the service description is either empty or contains 'Network'. This combination of characteristics can indicate the installation of a malicious service, potentially a backdoor or trojan, attempting to masquerade as a legitimate system service.
This rule detects potential ransomware activity by monitoring for a high volume of file creation or renaming events where the new file names end with common ransomware extensions such as '.encrypted', '.locked', or '.crypted'. It aggregates these events over 5-minute intervals and triggers if 50 or more such files are observed on a single device.
This rule detects suspicious file activity indicative of ransomware by monitoring for a high volume of file creations or renames where the filenames contain common ransomware-related extensions such as '.encrypted', '.locked', or '.ransom'. It aggregates these events over a one-hour period per device and triggers if 20 or more such events occur.
This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.
Detects network activity initiated by the TukTuk malware to communicate with Arweave public gateways (arweave.net and g8way.io), which are utilized as dead-drop resolvers for C2 infrastructure resolution.
This rule detects suspicious activity based on a set of Indicators of Compromise (IOCs) including malicious IP addresses, domains, URLs, and file hashes (SHA256). It monitors network connection events for communication with known malicious IPs, domains, or URLs, and file/process events for the execution or presence of files with known malicious SHA256 hashes.
Detects the execution of the NUKESPED backdoor component 'zlrenu8.exe', which is associated with Kimsuky threat actor activity. This component is known to function as a keystroke logger using SetWindowsHookEx to capture user input.
Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
Detects outbound HTTP POST requests characteristic of QakBot malware command and control (C2) activity. The rule identifies a specific combination of a hardcoded User-Agent string ('Trident/7.0') and a URI pattern consisting of 4 to 32 alphanumeric characters ending in .php.
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
Detects instances where rundll32.exe is spawned by PowerShell.exe, specifically targeting patterns often associated with malware downloaders and stage-two payload execution. The rule filters out common system DLLs and legitimate rundll32 usage to reduce noise.
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
Detects behavior indicative of the Remcos RAT injecting its code into legitimate Windows processes (such as iexplore.exe, ieinstal.exe, ielowutil.exe, svchost.exe, or explorer.exe). The rule identifies this by monitoring for a process matching the Remcos naming convention that launches a secondary process in a suspended state, followed by cross-process activity that deviates from standard system behavior.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
Detects the execution of known Remcos Remote Access Trojan (RAT) watchdog processes (e.g., iexplore.exe, svchost.exe, fsutil.exe) when spawned by suspicious parent processes or running from non-standard file paths such as Temp, AppData, or ProgramData, which are common indicators of malicious activity.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Page 77 of 232