Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
223 detections
Filters
Last updated
All Time
Detection languages
105
45
18
16
11
Contributors
55
48
19
17
11
Categories
85
79
49
42
38
Platforms
95
83
25
24
20
Products / Services
62
28
27
21
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
5
5
5
5
IDS Classtypes
11
4
1
IDS Protocols
6
5
3
2
This rule detects trojanized Linux binaries, specifically targeting those that resemble Kaiji malware. The combination of these strings suggests a malicious binary with persistence and potential crypto-mining capabilities.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
This rule detects the creation of specific mutex names that are known to be associated with GuptiMiner activity. The mutex names include patterns like 'Mutex_ONLY_ME_V<version>', 'SLDV<2-3 numeric>', 'GlobalMIVOD_V4', 'MIVOD_6', and 'MTX_EX01'. Detection of these mutexes indicates the presence or execution of the GuptiMiner malware on a Windows system, which is known for cryptocurrency mining and backdoor capabilities.
The rule detects the creation of processes that utilize specific mutex names associated with CoinHelper miner activity. Specifically, it looks for the mutex name 'QPRZ<digit>bWvXh'. The detection is based on the 'process_creation' log category on Windows systems.
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Detects HTTP POST requests containing a JSON-RPC payload with the 'eth_call' method. This is often used by web-based crypto wallets or dApps to interact with the Ethereum blockchain, but can also be used by malicious JavaScript for activities like cryptojacking or wallet draining.
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Detects the execution of Asterisk PBX management commands to enumerate channels or peers, originating from a web server user. This behavior is indicative of a compromised web application or web shell, such as EncystPHP, being used to inspect or hijack telephony resources.
This rule detects network connections to known cryptocurrency mining pools or domains associated with cryptocurrency mining activities. It specifically looks for keywords like 'miningpool', 'stratum', 'xmr', 'ethash', 'moneropool' in the remote URL or specific IP addresses like 'connect.moneropool.com' and 'pool.supportxmr.com'. This activity often indicates unauthorized resource hijacking (cryptojacking) on the affected device.
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.
Identifies clients that may be performing DNS lookups associated with common currency mining pools.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Detects initiated network connections to crypto mining pools
Detects network connections utilizing specific URL paths associated with Prometei botnet malware distribution and command-and-control (C2) communication.
Detects command line parameters or strings often used by crypto miners
'Indicates when an anomalous number of resources are created in Azure via AzureActivity log. Resource creation could indicate malicious or spurious use of your Azure Resource allocation.'
Detects command line parameters or strings often used by crypto miners
'Identifies when a new user is granted access and starts creating resources in Azure. This can help you identify rogue or malicious user behavior.'
Page 9 of 11