Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
19
3
3
2
2
Contributors
9
2
2
2
2
Categories
24
10
7
6
4
Platforms
20
9
2
1
Products / Services
14
4
2
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the 'FileGrabber' component of the Amos infostealer on macOS. This rule specifically looks for command-line arguments containing both 'FileGrabber' and '/tmp', indicating the execution of this malicious component, which is known to target sensitive user files.
This rule detects indicators of compromise (IOCs) associated with the 'ManualFinder/PDF Editor' malware campaign. It identifies malicious activity across multiple data sources, including file hashes, process hashes, suspicious certificate signers, suspicious company names in version info, suspicious file descriptions, malicious command execution, and network connections to known command and control (C2) or malicious PDF-related domains. The rule leverages external data sources for IOCs such as file hashes, C2 domains, PDF-related domains, suspicious signers, and malicious commands. It also includes static IOCs like specific file descriptions and company names. The detection logic is designed to identify various stages of the malware's activity, from initial execution to network communication.
Detects the execution of an application from a mounted disk image (DMG) with a name known to be used by Odyssey Infostealer. This activity is indicative of initial access, where the user has been tricked into running a malicious application masquerading as a legitimate software installer or updater.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
This rule consolidates multiple detections related to a widespread malspam campaign delivering the Nova infostealer. It hunts for activity across email, network, DNS, and firewall logs associated with known malicious domains, IPs, and specific TTPs like suspicious archive attachments from impersonated brands.
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
This analytic detects suspicious processes accessing registry entries related to default internet browsers. It specifically looks for Windows Security Event Code 4663, which indicates an attempt to access registry paths associated with browser configurations. Adversaries often target these registry keys to gather information about installed browsers and their settings, which can lead to the theft of sensitive data like login credentials and browsing history. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, this activity could enable attackers to exfiltrate sensitive information and compromise user accounts.
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
Page 2 of 2