Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects potential command and control or malicious file staging activity by correlating DNS TXT record queries (often used for data exfiltration or staging configuration) performed by common system utilities (nslookup, PowerShell) with the subsequent execution of files from suspicious directories (Downloads, Temp) within a 30-minute window on the same device.
Detects potential malicious PowerShell activity involving suspicious file paths in 'C:\Users\Public\' and the use of 'UPLOAD' command strings, which may indicate the staging and execution of payloads.
Detects a multi-stage process execution chain beginning with common end-user applications (browsers, Office apps, explorer.exe) spawning known LOLBins (Living-off-the-Land Binaries), which in turn execute secondary LOLBins with suspicious command-line indicators. This pattern often signifies post-exploitation activity such as secondary payload delivery, fileless malware execution, or proxy execution of malicious scripts/commands, consistent with ClickFix or BYOVD-related ingress techniques.
Detects the execution of Python interpreters from user-writable directories (Temp, Downloads, AppData) when launched by common LOLBins or shell-like parents, which is indicative of the CastleLoader 'ClickFix' phishing chain where attackers deploy a portable Python runtime to execute malicious payloads.
Detects potential multimodal prompt injection attacks where an AI agent process ingests a file (PDF, image, etc.) from a browser or mail client and subsequently performs suspicious downstream activity, such as spawning a shell with execution primitives or making network connections to rare, non-reputable external domains. Covers T1204, T1059, T1105
Detects malicious bash scripts identified as part of the BYOB C2 framework infrastructure. These scripts are designed to download and install second-stage payloads such as Meterpreter or XMRig-style cryptominers. The rule identifies these scripts by their specific naming conventions, embedded C2 infrastructure indicators, and persistence mechanisms including crontab, systemd, and rc.local.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
Detects the use of PowerShell processes that employ command-line encoding (e.g., -enc, -EncodedCommand) in conjunction with download-related cmdlets (e.g., DownloadString, IEX, Invoke-WebRequest), or instances of PowerShell spawned as a child process of another PowerShell process. This pattern is indicative of a loader or stage-one script fetching additional malicious payloads.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects network connections to known ChatGPT Custom GPT ClickFix campaign infrastructure (IPs and URLs) as reported by Huntress. This rule covers the network_connection logsource only. Domain/DNS matching is covered by a separate dns_query rule, and file-hash matching is covered by a separate process_creation rule, as Sigma only supports one logsource per rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Detects DNS queries to chattypetty.com, associated with the ChatGPT Custom GPT ClickFix campaign (Huntress reporting).
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
This is one of three logsource-scoped rules split from a combined KQL IOC hunt because Sigma only supports one logsource per rule.
IP/URL matching is covered by a separate network_connection rule; file-hash matching is covered by a separate process_creation rule.
Page 18 of 121