Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
20
12
7
3
3
Contributors
13
9
4
4
4
Categories
17
14
11
8
6
Platforms
38
8
5
5
1
Products / Services
15
8
5
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
Detects execution of MediaPatcher.app decoy application used for credential harvesting.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
When the OneLaunch application is installed it will attempt to get updates from this domain.
When the OneLaunch application is installed it will attempt to get updates from this domain.
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.
A keylogger is an insidious form of spyware. when we enter sensitive data onto keyboard, believing nobody is watching. In fact, keylogging software is hard at work logging everything that you type. Keyloggers are activity-monitoring software programs that give hackers access to your personal data. The passwords and credit card numbers you type, the webpages you visit – all by logging your keyboard strokes. The software is installed on your computer, and records everything you type. Then it sends this log file to a server, where cybercriminals wait to make use of all this sensitive information.
Detects known samples of the Katz Stealer infostealer based on their SHA1 file hashes.
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
Detects DNS query requests to "update.onelaunch.com". This domain is associated with the OneLaunch adware application.
When the OneLaunch application is installed it will attempt to get updates from this domain.
When the OneLaunch application is installed it will attempt to get updates from this domain.
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
Page 3 of 3