Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potential BabylonRAT malware samples by identifying a combination of dynamic API resolution techniques (using GetProcAddress and LoadLibrary) and XOR-obfuscated string blocks representing critical DLL and API names. The detection utilizes high file entropy and specific artifact strings to identify binaries attempting to evade static analysis.
Detects the creation of Windows Run registry keys by a process named 'firefox.exe' that originates from a non-standard file path. This behavior is indicative of BabylonRAT attempting to establish persistence by masquerading as the Mozilla Firefox browser.
Detects Windows PE files exhibiting characteristics of BabylonRAT, specifically the use of dynamic API resolution via GetProcAddress and LoadLibrary to hide imports, combined with XOR-obfuscated strings for sensitive functions like CreateProcess, WriteFile, and InternetOpen to evade static analysis.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Detects PowerShell scripts attempting to identify security software, virtualization environments, or sandbox analysis tools. The rule monitors for the enumeration of security processes, WMI queries for system hardware information (e.g., BIOS, Disk, Video Controller), and checks for registry keys or driver files associated with virtualization software (e.g., VMware, VirtualBox). This behavior is commonly observed in malware attempting to evade automated analysis.
Detects the reflective loading of .NET assemblies into memory using APIs like Assembly.Load or Reflection.Emit, where no corresponding DLL file is written to the disk. This technique is often used by malware (such as the Stella_Gary backdoor) to execute code in a fileless manner and evade disk-based security detections.
This rule detects files that feature a valid RTF file header (literal '{' followed by 'rtf1') at the start of the file, but lack standard RTF control words such as \ansi or \fonttbl. The presence of executable content, PowerShell commands, or script markers within these files indicates a file-type masquerading technique used to bypass security controls by disguising malicious payloads as RTF documents.
This rule detects the creation of scheduled tasks that attempt to masquerade as legitimate Google Chrome Update tasks. It flags tasks that use the 'Google Chrome Update' name but do not follow the standard naming convention (which typically includes 'GoogleUpdateTaskMachine') or tasks that initiate suspicious actions using scripting engines (like PowerShell, cmd.exe, mshta, etc.) rather than the signed Google update binary.
Detects the execution or creation of files masquerading as Mozilla Firefox components (e.g., firefox.exe) located within non-standard, suspicious directories under 'ProgramData'. The rule further refines these alerts by identifying instances where the file lacks a valid Mozilla digital signature or contains an incorrect company name in its metadata.
Detects instances where a process masquerading as Firefox (executing outside of legitimate program directories) attempts to modify the Windows 'hosts' file. This behavior is indicative of BabylonRAT or similar malware attempting to redirect network traffic to malicious domains by tampering with local DNS resolution.
Detects instances where a process masquerading as Firefox (executing outside of legitimate program directories) attempts to modify the Windows 'hosts' file. This behavior is indicative of BabylonRAT or similar malware attempting to redirect network traffic to malicious domains by tampering with local DNS resolution.
Detects potential keylogging behavior by identifying a process masquerading as firefox.exe that is operating from an unauthorized directory while utilizing keyboard hooking (SetWindowsHookEx) or polling (GetAsyncKeyState) APIs, a technique consistent with the BabylonRAT malware.
Detects the use of PowerShell to load .NET assemblies into memory using the Assembly.Load method. This technique is often employed by adversaries to execute malicious payloads reflectively, avoiding the creation of files on disk.
This rule monitors for security-related account activities in Azure AD, specifically tracking self-service password resets, admin-led password resets, and changes to user security information. It aggregates these events by user to identify potential account manipulation, unauthorized password changes, or MFA registration abuse.
Detects when a user who has successfully authenticated to a system is subsequently added to the 'Domain Admins' group within a 15-minute window. This behavior often indicates an adversary performing privilege escalation after gaining initial access to an account.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
Page 153 of 864