Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the modification of the Windows Registry 'LegalNoticeText' key, which is used to display a message to the user upon logon. This specific rule flags the inclusion of known ransomware-related URLs or domains in the text, commonly used as a ransom note mechanism by adversaries.
Detects core indicators of Grixba malware, including the persistence path of GT_NET.exe in the Public Music directory, the loading of the associated malicious CoreScanner module (inf_g.dll), staging of reconnaissance output files, and the use of GT_NET.exe to perform network lateral movement via WMI/WinRM ports.
Detects the execution of VILE ransomware by identifying specific Go runtime and malware-specific strings in the command line. The detection logic focuses on artifacts related to sandbox and debugger evasion techniques, such as breakpoint trap detection, memory checks, and inspection of the Process Environment Block (PEB) via 'RtlGetCurrentPeb', as well as internal identifiers associated with the VILE ransomware binary.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects the presence of debugger context strings indicative of Makop's loader exception triggering, specifically looking for '.cxr ' or 'dump context' in the process command line. This behavior is often associated with anti-analysis techniques used by malware like Makop Ransomware to detect and evade debugging environments.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects shell commands querying attacker-controlled domains disguised as Apple driver stores to fetch malicious macOS backdoors, specifically looking for 'coreaudiod' or 'audio-issue-fix.sh' in the URL.
Detects network connections to specific IP addresses associated with websocket protocols
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' within the RemoteUrl field, which often indicates communication with a C2 server using a UUID-like identifier.
This rule detects WebSocket communication attempts from a device to known command and control (C2) IP addresses associated with the Remcos Remote Access Trojan (RAT). It specifically looks for network events where the remote URL contains 'ws://', 'wss://', or 'websocket' and the remote IP address matches one of the listed indicators of compromise (IOCs).
Detects the execution of `cmd.exe` with the `/c` argument to open a PDF file, originating from specific `AppData` subdirectories. This behavior is consistent with the SharkLoader dropper, often associated with the StrikeShark campaign, which uses decoy PDF documents to initiate its infection chain.
This rule detects potential DarkCloud RAT activity by looking for specific strings in process command lines. The strings 'darkcloud', 'dark.cloud', 'cloud.dll', or 'shadow.exe' are indicative of the RAT's components or communication patterns.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
This rule detects various techniques used by the Lambsys malware for persistence, watchdog monitoring, and cryptocurrency mining on Linux systems. It monitors for crontab modifications, the execution of hidden watchdog scripts in /var/tmp, the usage of pgrep to monitor the miner, and the detachment of processes via nohup.
Detects command-line execution patterns associated with the BumbleBee malware loader, specifically looking for process names like 'secur.exe', 'secure.exe', 'update.exe', or the string 'bumblebee' within the command line arguments.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects the initial stage of the Meow RAT ClickFix campaign, specifically targeting fileless zsh loaders. This rule identifies command-line executions involving 'zsh', 'bash', or 'sh' that combine 'eval', 'base64', 'gzip', and either 'curl' or 'osascript', often with redirection to /dev/null. This pattern is indicative of a gzip+base64 encoded heredoc being fetched via curl and executed in memory, followed by osascript for further actions.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Page 94 of 232