Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects browsers loading external anomalous scripts from known malvertising domains while visiting plaintext HTTP sites (Router injection). This rule specifically looks for network connections on port 80 (HTTP) that are joined with device network events where the remote URL matches a regex for known malvertising domains (.xyz, .top, .site) and ends with '.js', indicating an injected script.
This rule detects when the Remcos RAT loader attempts to access browser cache folders (Chrome, Firefox, Opera). This activity is indicative of credential dumping, where the malware tries to extract sensitive information like stored passwords or session tokens from web browsers.
This rule detects suspicious execution of VBScript or VBE files via wscript.exe or cscript.exe where the command line contains keywords commonly associated with financial documents or urgent requests. A high count (3 or more) of such events from a single device within an hour is considered anomalous, potentially indicating a phishing attempt or malware execution.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting to resolve dynamic commands or addresses.
This rule detects network connections where a non-browser process (specifically excluding Chrome, Edge, and Firefox) attempts to resolve dynamic commands or addresses using the JSON-RPC 'eth_call' method. It specifically targets scenarios where this activity is associated with known malware structures like SessionGate, Remus, or AnimateClipper, rather than a standalone executable name. The detection logic looks for 'eth_call' in either the DomainName or the ContextProcessCommandLine fields during network connection events.
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' which often signifies communication with a C2 server using a specific API endpoint and a GUID-like identifier.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an `AppData` directory.
Detects a non-browser process reading active browser titles, URLs, or accessibility trees and matching Brazilian bank names before activating fraud modules. Specifically, it looks for processes named 'banana', 'client', 'update', or 'service' (case-insensitive) that are executing commands related to UI automation or window title retrieval, and simultaneously searching for banking-related keywords like 'bank', 'internet banking', 'agencia', or 'conta'.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects non-browser HTTP POST requests containing both 'access_token' and step-style parameters (e.g., 'step', 'stage', 'counter' followed by a number) in proxy or firewall telemetry. This rule specifically targets patterns associated with malware communication, such as SessionGate, Remus, or AnimateClipper, by excluding common browser user agents.
Detects the self-deletion pattern used by the Supper backdoor, which involves a specific 'ping' command delay structure followed by a 'Del /f /q' command to remove itself from disk after execution. This pattern has been associated with Interlock and Rhysida ransomware.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Page 95 of 232