Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Identifies the presence of the known ITScape (CVE-2026-46316) proof-of-concept executable by its SHA256 hash. This vulnerability enables a critical guest-to-host escape affecting ARM64 infrastructure.
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects ListPlanting injection using LVM_SORTITEMS and SendMessage API
Detects malware checking for user activity to detect sandbox environments
Detects malware checking environment variables before executing payload
This rule detects the creation or modification of a Windows scheduled task that includes 'deno' in its command line. This activity is suspicious as it can indicate malware establishing persistence on a system, especially on typical office PCs where Deno is not commonly used. Further investigation is recommended to determine if the activity is legitimate or malicious.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects the creation or manipulation of mutexes by processes that contain keywords associated with the Remcos RAT (Remote Access Trojan). Specifically, it looks for command-line arguments containing "Remcos_Mutex_Inj", "Remcos_Mutex", "mutex", or "CreateMutex". This activity can indicate the presence or execution of Remcos RAT on a system, as mutexes are often used by malware for single-instance enforcement or inter-process communication.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Detects potential Remcos RAT loader activity involving process hollowing or injection into browser processes. This rule specifically looks for common browser executables (iexplore.exe, chrome.exe, firefox.exe) where the initiating parent process is 'Optimax.dll' or contains 'SystemOptimizer', which are indicators associated with the Remcos RAT loader.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
Detects a non-browser process searching for Chromium Login Data, Cookies, Local State, or Firefox logins and key databases. This activity is indicative of credential access attempts where an attacker tries to extract sensitive information stored by web browsers.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Detects Node.js executing inline base64 encoding specifically aimed at configuration files prior to exfiltration.
Identifies the creation of the specific mutex used by this Makop ransomware variant to prevent multiple infections.
Detects the use of the Electron setLoginItemSettings API for startup persistence. This API allows Electron-based applications to configure themselves to launch automatically when a user logs in, which can be abused by adversaries to maintain access to a system.
Page 64 of 84