Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,464
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects HTTP GET requests to a specific self-hosted GitLab domain 'gitlab.bzctoons.net' that attempt to download a file named 'protected.zip', which is associated with the retrieval of StealC information-stealing malware by the Amadey loader.
Detects the LokiBot information stealer by identifying its characteristic aPLib compressed payloads, specific C2 URI patterns, known C2 infrastructure, and credential theft routines targeting applications like 1Password, Keepass, and WinBox.
Detects execution of a renamed pythonw.exe (userscreen.exe) from a suspicious location (Public\AccountPictures) that demonstrates short-lived execution characteristics indicative of a sandbox/VM evasion check, immediately followed by network connectivity to known NarwhalRAT C2 domains or pcloud infrastructure.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
Detects indicators of Akira ransomware activity, including execution of the binary, dropping of ransom notes, renaming of files with .akira extension, and the use of vssadmin to delete volume shadow copies.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects GreenBlood ransomware or similar threats accessing Outlook PST/OST/EML/MSG email files from non-Outlook processes, potentially indicating data theft for double extortion. The rule specifically looks for file read, access, or creation actions on these email file types within common Outlook or user data folders, excluding legitimate processes that typically interact with these files.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
This rule detects the execution of 'vaultsvc.exe' or executables starting with 'WindowsVault' and ending with '.exe' from suspicious, non-standard directories such as AppData, ProgramData, or Temp. It also flags execution from any non-system path if not in System32, SysWOW64, or Program Files. A known malicious hash for 'vaultsvc.exe' is specifically identified.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
This rule detects potentially malicious behavior associated with the DragonReturn malware, including the loading of a specific DLL (nvdaHelperRemote.dll) by system processes or Mixed Reality tools, the execution of suspicious binary names, and network connectivity indicators related to C2 domains.
Detects instances where the svchost.exe process is associated with multiple occurrences of indicators categorized as 'Misc', potentially indicating malicious activity or process abuse that bypasses standard detection signatures.
Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.
Detects outbound network connections to TCP port 4001, which is the hardcoded default C2 port for SystemBC (Coroxy) malware. The rule identifies suspicious proxy tunnel establishment from Windows workstations, often used by threat actors like Wizard Spider and FIN7 for pre-deployment staging.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Detects indicators of Mustang Panda activity, specifically identifying the loading of known malicious side-loaded DLLs (SolidPDFCreator.dll, ctxmui.dll) or anomalous process behavior originating from staging directories (e.g., \ProgramData\IDM\logs\) and binaries (MediumInstStart.exe, pct2bmp.exe) that interact with common system or browser processes.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of ErrTraffic webshell activity.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
This rule detects a sequence of events indicative of ransomware deployment following a successful Remote Desktop Protocol (RDP) connection. Specifically, it looks for an inbound RDP connection (RemotePort 3389) to a device, followed within 60 minutes by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') on the same device. This pattern suggests an attacker gaining initial access or moving laterally via RDP and then deploying ransomware.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
Page 88 of 232