Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects GreenBlood ransomware activity targeting network shares and USB drives. This rule identifies file rename or creation events with specific ransomware extensions (.tgbg, .bak) or ransom note filenames ('READ_ME_TO_RECOVER_FILES.txt'), combined with the use of extended path prefixes (\?\ or \?\UNC\) often employed by ransomware for network/UNC path targeting. The rule aggregates these events and alerts if three or more such files are detected from a single process on a device.
Detects macOS.Gaslight malware activity through two branches: direct hash matches of known binaries and the spawning of Python subprocesses with specific command-line arguments indicative of data collection or archiving. The Python subprocess detection looks for Python scripts being executed from '/tmp/' or '/Library/' directories with arguments related to browser data collection, keychain access, or archiving operations.
Detects Remcos RAT attempting process hollowing into common web browser executables. This rule identifies several indicators: creation of the 'Remcos_Mutex_Inj' mutex, a sequence of API calls (VirtualAllocEx, WriteProcessMemory, NtUnmapViewOfSection) targeting browser processes from a non-browser process, and the presence of a known Remcos payload MD5 hash (4924369C0BDAF73B21EB992EB9DB4DEA).
This rule detects potential DLL side-loading activity associated with the SilverFox threat actor, specifically targeting trojanized Panasonic and Philips OEM software. It looks for suspicious DLLs (UxEnhance64.dll, XPSPLOG.dll) being loaded, or legitimate Panasonic/Philips binaries loading DLLs from non-standard paths, including the Public user directory.
Detects Vidar Stealer's characteristic behavior of spawning a suspended Chrome instance with specific command-line arguments (--no-first-run --disable-gpu about:blank) followed by APC (Asynchronous Procedure Call) injection. This technique is often used by Vidar to inject malicious code into the suspended Chrome process, potentially after bypassing security product checks.
Detects common self-deletion patterns used by Pony malware, including the use of 'cmd.exe' with 'del /f' targeting executables in temporary or application data directories, batch file self-deletion loops, and PowerShell 'Remove-Item' or '[System.IO.File]::Delete()' targeting its own image path.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
This rule detects suspicious process injection activity where an untrusted process attempts to inject code into common trusted Windows processes (svchost.exe, explorer.exe, notepad.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe) using a combination of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls. This behavior is often associated with malware, such as StealC, attempting to evade detection and maintain persistence.
This rule detects the presence and execution of the GLASSWORM.WASM TinyGo-compiled WebAssembly loader. It identifies suspicious file creations of .wasm files or known malicious JavaScript shim files within VS Code extension directories, as well as the execution of node.exe loading .wasm files or known malicious JavaScript shims from these paths. Detection is based on specific file names, folder paths, and a known malicious SHA256 hash.
Detects AstarionRAT installing a global keyboard hook (SetWindowsHookEx) to capture user keystrokes. This rule relies on advanced API tracking telemetry to identify the SetWindowsHookExApiCall action type and then joins with process events to filter for executables running from the AppData folder.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects the creation of suspicious scheduled tasks associated with TrymeLocker ransomware. The rule monitors for tasks named 'RageGuard' or 'win_guard', as well as tasks registered with high privileges using non-standard file paths such as AppData, Temp, or ProgramData, triggered by system logon or startup.
Detects keylogging behavior associated with the TrymeLocker malware. The rule monitors for processes executing from non-standard, potentially writable directories (such as Temp, AppData, or ProgramData) that load user32.dll. This activity is indicative of an attempt to install a global Windows hook (SetWindowsHookEx) to intercept keystrokes (WH_KEYBOARD_LL).
Detects the SNOWLIGHT dropper attempting to detect analysis or security tools by rapidly enumerating common debugging, profiling, and analysis executables (such as x64dbg, IDA Pro, Wireshark, Process Hacker, etc.). The rule triggers when a single process queries at least 3 distinct blacklisted tool names more than 5 times within a 1-minute window, a characteristic behavior used to identify and evade analysis environments.
This rule detects potential VILE ransomware activity by identifying a specific combination of Windows token manipulation APIs (e.g., AdjustTokenPrivileges, DuplicateTokenEx) paired with the usage of VILE-specific direct NT syscalls (NtCreateWaitCompletionPacket, ProcessPrng) within the same process context. This behavioral pairing serves as a high-fidelity indicator of VILE ransomware execution.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
Detects the execution of the Grixba infostealer, which registers a Vectored Exception Handler (VEH) using AddVectoredExceptionHandler. This behavior is used by the malware for execution hijacking and debugger evasion to maintain persistence and prevent analysis. The rule monitors for processes identified as Grixba based on specific naming conventions or execution from suspicious paths like C:\Users\Public\Music\.
Detects Grixba infostealer execution from the C:\Users\Public\Music\ staging path, identified by the creation of RWX (PAGE_EXECUTE_READWRITE) memory regions and the registration of Vectored Exception Handlers (VEH). These behaviors are indicative of advanced process injection techniques used during the preparation phase of malware execution, often associated with the Play Ransomware group.
Detects the execution of the Grixba infostealer, associated with the Play Ransomware group, which is known to perform ntdll EDR unhooking. The rule specifically monitors the launch of the identified malicious binary (Gt_net.exe or GT_NET.exe) from the C:\Users\Public\Music\ directory, a behavior observed consistently across Grixba versions.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
Page 93 of 232