Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,464
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
Detects file creation events associated with the UAC-0226 campaign, specifically targeting Ukrainian military-themed lures and staging artifacts related to the GIFTEDCROOK malware. This rule monitors for the presence of specific file paths and naming conventions indicative of ongoing espionage operations.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Detects the execution of DcRAT malware by monitoring for the creation of the specific global mutex 'Global\ShitSetupOn26126k' commonly used by this strain to enforce single-instance execution on a host.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query, which are indicators of the ErrTraffic webshell activity.
Detects powershell.exe executing a hidden .ps1 script from AppData\Local\Temp using character-code string concatenation obfuscation ([char]N+[char]N) and ForEach-Object {[char]$_} patterns, consistent with the TuglaInsaatci/Remcos steganographic loader campaign dropping pmxhtzb4w2q.ps1 for persistence.
Detects the steganographic loader campaign setting HKCU Run key persistence using powershell.exe with -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File pointing to an obfuscated .ps1 script in AppData\Local\Temp, as observed in the FortiBleed/TuglaInsaatci campaign delivering Remcos RAT.
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
This rule detects Python or Node.js processes aggressively accessing directories associated with cryptocurrency wallet browser extensions like MetaMask, Phantom, and Binance Chain. This activity is indicative of information stealer malware attempting to exfiltrate sensitive wallet data.
Detects SystemSettings.exe running from user-writable AppData or ProgramData directories, or SystemSettings.dll being loaded by SystemSettings.exe from these locations. This behavior is indicative of SharkLoader DLL sideloading, often used as a first stage in attacks.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects file creation or process execution originating from or referencing a folder named 'GentlemenCollection', which is a known staging directory used by the Gentlemen RaaS EDR killer framework prior to ransomware encryption.
This rule detects network connections to remote URLs containing indicators associated with the XWorm Remote Access Trojan (RAT). It specifically looks for 'xworm', 'x-worm', 'wormx', or '/xworm' within the RemoteUrl field of DeviceNetworkEvents.
This rule detects the creation of a 'logs.dat' file, which is often associated with Remcos RAT for data exfiltration, in common user-related directories (AppData, Temp, Users, Documents) with a file size greater than or equal to 100KB. This pattern suggests an attempt to stage or exfiltrate collected data.
This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware like SessionGate, Remus, or AnimateClipper attempting dynamic command or address resolution related to blockchain interactions.
Page 91 of 232