Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects the execution or presence of batch files named 'Invoice Details.bat'. The use of such naming conventions in scripts is often a tactic employed in phishing campaigns to lure users into executing malicious code disguised as business-related documents.
This rule detects the presence or execution of a specific file on a device, identified by its SHA256 hash. The rule monitors both file creation/access and process execution events to identify if a known malicious binary is interacting with the system.
This rule monitors for the presence of files matching a known list of malicious SHA256 hashes on devices. It correlates these file events with process creation events occurring on the same device within a 10-minute window, identifying potential execution of malicious binaries or artifacts.
Detects Java-based Metasploit/Meterpreter payload files (.class/.jar) dropped post-exploitation, as observed following PaperCut RCE exploitation chain
This rule detects the execution of a file with a suspicious media-themed filename (e.g., related to 1080p, BluRay, etc.) from a known BitTorrent client process, followed by an immediate network connection to a known malicious C2 IP address or domain within a 10-minute window. This behavior is indicative of a user downloading and executing a malicious file disguised as pirated media.
Detects the execution of suspicious binaries that are spawned by known torrent clients or appear to masquerade as media files (e.g., using movie quality naming conventions like 1080p, Bluray). This rule identifies potential delivery of malicious payloads via P2P file sharing environments by looking for specific process patterns and filename indicators associated with file masquerading.
Detects a Delphi-compiled Windows Screen Saver (.scr) file acting as a dropper. The binary contains embedded RCDATA ZIP resources and utilizes Persian-language filenames related to academic or student-focused lures to trick victims into execution. This rule specifically identifies the presence of the dropper's strings and the Borland Delphi marker.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects the execution of Ruby or Yard processes where specific command-line arguments (e.g., --load) are used to invoke potentially malicious Ruby script files like evil.rb, loader.rb, or script.rb. This pattern is indicative of an adversary leveraging existing legitimate tools to execute arbitrary script code.
Detects known malicious SilverFox payloads by comparing the file hash against a list of known SHA256 signatures associated with the malware.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Matches known Phantom Stealer MaaS infostealer sample hashes
Matches known Phantom Stealer MaaS infostealer sample hashes
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Matches known SilverFox malware payload samples by SHA256 hash
This rule detects the sequence of an external file download over HTTP, followed by the immediate creation and execution of an executable file (.exe, .dll, .scr) on the endpoint. It specifically filters out common system installers (e.g., msiexec.exe, trustedinstaller.exe) to reduce noise, focusing on potentially malicious payloads delivered via network channels.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Page 29 of 86