Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
6
1
Contributors
5
1
1
Categories
6
3
2
2
1
Platforms
6
1
Products / Services
6
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.
This rule detects the execution of processes that contain keywords associated with Agent Tesla, RedLine, or other stealers in their command line, specifically when initiated by common Windows utilities like PowerShell, CMD, or rundll32. This pattern often indicates the loading or execution of malware.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
This rule detects the presence of files on endpoints that match a list of known malicious SHA256 hashes associated with the Nuso malware. It queries DeviceFileEvents to identify any file with a matching hash.
This query uncovers seen IPAddressV4 network subnets
