Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects known samples of the Atomic Stealer (AMOS) malware on macOS, specifically those associated with the Macfinger/ClickFix campaign, by matching their SHA256 hashes.
Detects the Sauron Loader malware pattern where a payload is downloaded or retrieved and written to a randomly named file within a temporary directory, followed by the immediate execution of that staged file. This behavior is indicative of C2 tasking involving payload staging.
Detects specific file hashes associated with Atomic macOS Stealer (AMOS) Mach-O payloads, which are often delivered via staging scripts on macOS systems.
Detects process and file creation activity matching known MovieReaper loader and downstream module file hashes (MD5/SHA256). C2 IP/domain network indicators for this campaign require a separate network_connection-category rule, since Sigma logsource categories cannot be mixed within a single rule.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
Detects the execution of 'htspnew.exe' by 'ubp.exe' where both executables are located in the same parent directory. This pattern may indicate suspicious process lineage or potential malware activity.
Detects instances where Windows Explorer (explorer.exe) spawns cmd.exe or wscript.exe to execute batch files (.bat) or scripts with specific filenames. This behavior is often associated with malicious user activity, such as executing payloads disguised as innocuous files triggered via shell interactions.
This rule detects the execution of 'DriverInstaller.exe' (either by filename or a known malicious SHA256 hash) that subsequently initiates network connections to GitHub domains. This behavior is indicative of potential malicious activity, such as downloading secondary payloads, command-and-control communication, or beaconing from a suspected rogue or masquerading driver installation utility.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
Detects execution of encoded commands in macOS terminal environments that originate from clipboard content mimicking a reCAPTCHA verification process. This pattern often involves users being social-engineered into pasting a malicious string that decodes a payload and pipes it directly into a shell interpreter (sh/bash/zsh). The rule monitors for the co-occurrence of base64/openssl decoding commands and shell execution pipes, while filtering out known legitimate software installation patterns.
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Detects Adobe Acrobat (Acrobat.exe) launched by a suspicious parent process (GRrte.exe) while opening a specific PDF document from the user's temporary directory. This pattern is indicative of a potential malicious document lure often associated with malware delivery.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
Detects the execution of suspicious binaries from the user's AppData Local Temp directory, often associated with AutoIt scripting or similar automation tools that utilize configuration (.ini) files to drive malicious activity.
Detects instances where Outlook (OUTLOOK.EXE) spawns an executable named 'ai.exe' with a command line containing a 16+ character hexadecimal string, followed closely (within 10 minutes) by a Microsoft Edge (msedge.exe) process execution acting as a network utility. This pattern is indicative of a potential phishing-initiated attack where a malicious payload is executed and subsequently leverages browser components for network communication or C2 activity.
This rule detects known JavaScript payloads associated with the JWR phishing framework by matching their SHA-256 file hashes. This is a signature-based detection for malicious script files commonly used in phishing attacks.
Page 21 of 86