Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
19
3
3
2
2
Contributors
9
2
2
2
2
Categories
24
10
7
6
4
Platforms
20
9
2
1
Products / Services
14
4
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects the execution of processes with command lines containing indicators associated with 'Phantom Stealer' malware, such as 'phantom stealer', 'stealer.dll', 'phantom.exe', or 'phtantom'. This could indicate an attempt to load or execute the stealer.
Detects Vidar Stealer attempting to access virtual memory of Chrome, Edge, or Brave processes to locate the v20_master_key, which is used to bypass Application-Bound Encryption. This rule also identifies suspicious browser process creations with specific command-line arguments that might indicate stealer activity.
Detects AMOS malware forking a child process, using setsid to detach from the Terminal session, and then killing the Terminal window via killall Terminal to evade parent-process tracking. This is a key behavioral indicator of the Atomic macOS Stealer delivered via ClickFix campaigns.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
This rule detects attempts to clean up artifacts associated with the Amos Stealer by monitoring for the deletion of known staging paths. Specifically, it looks for the execution of 'rm' commands targeting '/tmp/osalogging.zip' or '/tmp/sync'. This activity suggests an adversary is trying to remove traces of their presence after data exfiltration or staging.
Detects the execution of 'curl' with specific flags ('-kfsSL') often used for silent and insecure file downloads. This pattern has been observed in malware like Amos Stealer to download malicious payloads. The rule looks for 'curl' as the filename or at the beginning of the command line, combined with the specified flags and an HTTP/HTTPS URL.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Detects network connections to phishing domains mimicking Windows 11 download pages used to distribute infostealer malware.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
Detects the creation of malicious disk images (.dmg) or a dropper file (.msi) associated with the DigitStealer macOS infostealer campaign.
The following analytic detects non-Chrome processes accessing the Chrome "Local State" file, which contains critical settings and information. It leverages Windows Security Event logs, specifically event code 4663, to identify this behavior. This activity is significant because threat actors can exploit this file to extract the encrypted master key used for decrypting saved passwords in Chrome. If confirmed malicious, this could lead to unauthorized access to sensitive information, posing a severe security risk. Monitoring this anomaly helps identify potential threats and safeguard browser-stored data.
Page 1 of 2