Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects execution of curl piping to a shell interpreter (bash, zsh, sh) initiated directly from macOS Terminal or iTerm2. This pattern is characteristic of ClickFix-style social engineering attacks, where a user is prompted to copy and paste a malicious command into their terminal, which then downloads and executes a secondary stage, such as the Atomic macOS (AMOS) stealer.
Detects process and file creation activity matching known MovieReaper loader and downstream module file hashes (MD5/SHA256). C2 IP/domain network indicators for this campaign require a separate network_connection-category rule, since Sigma logsource categories cannot be mixed within a single rule.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
This rule detects a correlation between the creation or modification of a specific file name ('nloemfbihmhm') and the subsequent execution of processes from the 'Temp' directory involving related filenames ('kojuyn.ini', 'ogftogcyiblzjccmcbnw.exe', or 'nloemfbihmhm') within a 5-minute window. This behavior is indicative of a multi-stage execution chain, often used by malware to drop and execute secondary payloads.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the creation of a file named 'token.cmd' within the user's AppData\Roaming directory, followed immediately by the execution of that same file via 'cmd.exe'. The rule filters for specific file size characteristics to reduce noise.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects the creation of a shortcut (.lnk) file by the process 'OrionQuests-Setup.exe'. This activity is often associated with installers or applications placing shortcuts on the desktop or in startup folders for persistence or execution initiation.
Detects the execution of PowerShell from a shortcut (.lnk) file, particularly when suspicious command-line arguments such as hidden windows, encoded commands, or bypass flags are utilized. This pattern is commonly associated with initial access via malicious attachments or shortcut files.
Detects the creation of a file on the system that matches a known malicious SHA256 hash.
Detects the execution of processes containing indicators associated with Alinubx or the string 222024, which are potentially linked to malicious software or unauthorized tools.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Page 22 of 86