Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
71
25
18
10
6
Contributors
41
29
14
12
8
Categories
80
65
36
31
25
Platforms
77
51
16
13
3
Products / Services
70
64
16
11
8
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
40
30
1
IDS Protocols
28
19
19
3
1
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.
Yara rule that detects Voldemort backdoor.
Yara rule that detects GTPDOOR backdoor.
Yara rule that detects NoodRAT backdoor.
This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Yara rule that detects Krasue backdoor.
This rule detects the Encoded01 ransomware based on specific byte patterns found within the malware's executable. The patterns correspond to functions involved in file enumeration, file encryption, and remote connection activities, which are characteristic behaviors of ransomware.
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Page 7 of 7