Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects process activity indicative of keylogging by the Remcos RAT loader. The rule specifically looks for processes with 'Remcos' or 'GST*.com' in their file name that also contain command-line arguments related to capturing window text or foreground window information, which are common keylogger behaviors.
Detects outbound network connections to a known KuinaExtractor (k0to) infostealer C2 server. The rule monitors DeviceNetworkEvents for connections to the malicious IP address 103.229.53.18 on port 3000 and correlates them with process information to identify the originating application.
Detects the execution or file creation of identified Turla STOCKSTAY malware components, specifically targeting a list of known malicious filenames and installers used by this actor.
Detects the execution of suspicious files that exhibit characteristics of finance-themed malware droppers. This includes files with known malicious MD5 hashes, specific internal file metadata (original filename, file description, product name), or filenames masquerading as financial documents (e.g., 'GST Debit Note', 'RTGS_IMPS') with an executable extension like '.com'.
This rule detects the deployment and activity associated with the TrueSightKiller rootkit, potentially used by threat actors like SilverFox. It identifies several key indicators: the loading of 'truesight.sys' from non-standard directories, the creation of a staging file named 'ranchserv.jpg' in the Windows Temp directory by non-system processes, the presence of the 'truesight.sys' driver based on its known SHA256 hash, and the termination of security products shortly after the creation of TrueSightKiller-related artifacts.
This rule detects network connections to Google API domains (oauth2.googleapis.com, accounts.google.com, or any *.googleapis.com on port 443) initiated by processes that are not common browsers or Google update/crash handler executables. The detection is further narrowed down to processes executing from 'AppData' or 'Temp' directories, or specifically 'vaultsvc.exe', which are often indicators of suspicious or malicious activity.
Detects the execution of msiexec.exe spawned by WinRAR or unrar processes, specifically targeting the installation of STOCKSTAY payloads. This activity is indicative of exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088), where attackers extract malicious MSI files to unauthorized locations to bypass security controls and achieve code execution.
This rule detects the execution of PowerShell or AutoHotkey processes that include 'RtkLoggingManifest.man' in their command line. This behavior is indicative of AsyncRAT attempting to reconstruct a hidden .NET executable payload by parsing integers from a fake manifest file.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Detects suspicious access to browser credential stores (Google Chrome, Microsoft Edge, Mozilla Firefox, Brave) by non-browser processes within a short time frame (2 hours) after a FortiClient VPN logon event. This activity is consistent with information stealer malware, such as LummaC2, Phantom Stealer, Aurora Stealer, Luca Stealer, and Formbook, often observed in post-compromise phases of campaigns like FortiBleed.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects network communication to known Command and Control (C2) domains associated with the StrikeShark campaign. It uses a static list of domains identified in a Kaspersky report. While IOC-based, it's intended for immediate deployment for retrospective analysis and near-term threat hunting. The list of domains should be updated as new indicators emerge.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless Zsh loaders. This rule identifies the execution of Zsh, Bash, or Sh processes that combine 'eval', 'base64', and 'gzip' with 'curl' or 'osascript' in their command line, often including redirection to /dev/null. This combination indicates an attempt to fetch and execute a gzipped and base64-encoded payload directly in memory.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects the BQTLock malware's User Account Control (UAC) bypass technique. This technique involves modifying the registry key HKCU\Software\Classes\mscfile\shell\open\command to hijack the EventViewer COM object. Subsequently, eventvwr.exe is launched, which auto-elevates and executes BQT.exe, bypassing UAC.
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Detects execution of specific malware samples identified as DcRAT that perform environment checks, such as timing analysis using GetTickCount64 and Sleep, combined with system configuration lookups to identify sandbox or analysis environments.
Page 80 of 232