Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
35
33
7
3
2
Contributors
24
18
15
6
5
Categories
34
27
16
12
7
Platforms
52
19
6
6
5
Products / Services
20
13
7
5
5
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
IDS Classtypes
1
IDS Protocols
1
Detects the presence of a shared client-side JavaScript framework used in 'ClickFix' MaaS (Malware-as-a-Service) panels, specifically associated with the Exvicy and ErrTraffic campaigns. The rule identifies specific function patterns (e.g., xdReq, xdDec, waitForToken) and state machine logic (tokens, deduplication hashing) commonly used for token interception and clipboard interaction.
This rule detects potentially malicious interactions with Azure OpenAI deployments, specifically looking for prompts indicative of malware-authoring, safety filter bypass attempts, and abnormal volumes of requests from a single identity.
Detects PE files from the TAG-195 TinyEgg/ChonkyChicken/ChromEggscalator MaaS family via co-occurrence of distinctive embedded command markers, debug flags, and log path strings, requiring at least two markers to reduce false positives from individually generic strings
Detects AzureCommunication.dll C2 communication module by embedded strings or known hashes
Detects execution of TuxBot v3 multi-architecture ELF binaries, characterized by architecture-specific suffixes (e.g., tuxbot.x86_64) or the presence of the 'Infected By Akiru' banner in command-line arguments. These indicators serve as proxies for identifying this specific LLM-generated bot agent on disk or during runtime execution.
Detects HTTP POST requests to LLM chat completion API endpoints containing keywords associated with phishing kit generation, malware scaffolding, and automated credential harvesting. This behavior is consistent with attackers using LLM-assisted supply chain or phishing campaigns.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
Malvertising loader delivering CastleStealer via malicious Google Ads
This rule detects potential Mythic C2 implant or payload build activity occurring via Docker. It monitors for executions of docker.exe, docker-compose.exe, or docker commands initiated by shells (cmd.exe, powershell.exe) containing keywords associated with the Mythic C2 framework, while explicitly excluding common CI/CD runner parent processes to reduce noise.
This rule detects potentially malicious behavior associated with the DragonReturn malware, including the loading of a specific DLL (nvdaHelperRemote.dll) by system processes or Mixed Reality tools, the execution of suspicious binary names, and network connectivity indicators related to C2 domains.
Detects malicious msimg32.dll files associated with the Bumblebee loader by identifying unique, randomized, dictionary-derived strings within the PE file version resource metadata. These strings serve as a known signature for Bumblebee builders, often used to trojanize MSI installers.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
This detection is designed to help you find activity related to Intellexa Predator /
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
This rule identifies accounts receiving the most email and highest threat exposure by analyzing inbound email events. It counts total emails, delivered emails, junked emails, blocked emails, and specifically highlights emails with detected threats (Phish, Malware, Spam) that were successfully delivered to the user's inbox. The output is sorted to prioritize accounts with the highest number of delivered threats.
Detects known malicious file hashes associated with the VoidLink malware framework.
Page 1 of 4