Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.
This rule identifies execution traces indicative of the XCSSET macOS malware. XCSSET is known to spread via Xcode projects and maliciously modify applications. The rule looks for specific command-line patterns involving 'curl' to suspicious URLs, 'osacompile' and 'plutil' interacting with user and group containers, and 'zip' archiving data from user and group containers. These activities suggest potential command and control communication, persistence mechanisms, and data staging/exfiltration by the malware.
This rule detects the execution of a SILENTTRINITY stager by looking for the string 'st2stager' within the 'Description' field of process creation events. This string is typically found in the PE metadata of the stager executable, indicating its use.
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects SILENTTRINITY stager dll loading activity
Detects SILENTTRINITY stager use via PE metadata
Yara rule that detects ChinaZ trojan.
Yara rule that detects Linodas backdoor.
Yara rule that detects LimeRAT backdoor.
Yara rule that detects Krasue backdoor.
Yara rule that detects Konni backdoor.
This rule detects the Minodo backdoor by identifying a combination of specific byte patterns (YARA signatures) within executable files. These patterns correspond to functions responsible for generating system IDs, encrypting and sending data, gathering system information, copying payloads into memory, and executing payloads from temporary locations. The presence of all these patterns indicates the likely presence of the Minodo backdoor.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
Yara rule that detects GoodWill ransomware.
Yara rule that detects Jormungand ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
Yara rule that detects Prometey ransomware.
Yara rule that detects Curator ransomware.
Yara rule that detects Pay2Key ransomware.
Page 59 of 60