Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the steganographic payload extraction chain associated with the TuglaInsaatci .NET loader. The rule monitors for the sequential creation of 'payload.bin' (reconstructed from bitmap data) followed by the creation of 'Optimax.dll' on the same host, which is characteristic of the FortiBleed campaign's loader-as-a-service delivery methodology.
Detects the OXLOADER malware dropping a renamed copy of dui70.dll with a malicious RWX .xtext section into the user's Temp folder, followed by the loader process reading mpr.dll, which is a known behavior related to its sandbox check and API resolution execution chain.
Detects unauthorized access to Chromium-based and Firefox browser credential stores (Login Data, Cookies, logins.json) by processes executing from temporary directories (e.g., AppData, Temp). This behavior is characteristic of infostealer malware, such as CASTLESTEALER, often delivered via process injection or hollowed processes.
Detects potential sandbox evasion behavior characteristic of OXLOADER malware. The rule identifies a non-system process dynamically loading 'mpr.dll' and terminating shortly thereafter (within 1 minute). This sequence is associated with anti-sandbox techniques where malware attempts to trigger an error (e.g., ERROR_BAD_NAME 0x43) via a malformed UNC path using 'WNetAddConnection2W' to detect if it is running within an analysis environment.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
This rule detects the loading of Aspose.Email DLLs from suspicious user-writable or temporary directories. This behavior is indicative of an attacker potentially using a legitimate library for malicious purposes, possibly to evade detection or to collect information, rather than an approved mail application loading it from its intended location.
This rule detects the presence of a cluster of DLL names commonly associated with anti-analysis techniques used by malware, specifically Sprysocks. The DLLs 'snxhk.dll', 'SxWrapper.dll', 'SxIn.dll', 'SXIn64.dll', 'SbieDll.dll', and 'cmdvrt32.dll' are checked by malware loaders to identify sandbox or packet-capture environments. The rule triggers if at least three of these DLL names are found, indicating an attempt by malware to evade detection or analysis.
Detects python.exe loading non-standard Cython modules.
Gamaredon hides directories and replaces them with LNK files on removable media.
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
Identifies the threat actor executing PowerShell commands to add entire root directories (C:\) to Defender's exclusion list before dropping the ransomware payload.
Hunts for PowerShell scripts natively importing cryptographic classes (AesManaged, CryptoStream) to decrypt secondary payloads directly in memory.
Detects Nightspire ransomware configuring the machine to boot into Safe Mode with Networking to bypass third-party EDR/AV solutions before initiating the encryption routine. This is achieved by executing 'bcdedit.exe' with parameters to set 'safeboot network'.
Maps the execution of a VBScript payload decrypting the subsequent stages using hardcoded arrays. This rule specifically looks for VBScript commands that use the 'Split' function in conjunction with 'ChrW', which is a common pattern for obfuscated VBScript decoding routines.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
This rule detects potential DLL sideloading by identifying signed executables that load unsigned DLLs from user-writable directories, such as Temp, AppData, Downloads, or Documents. It excludes loads from standard, protected Windows directories to reduce noise.
Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.
Maps the behavioral sequence of a user mounting an ISO/IMG file (which bypasses MOTW) and subsequently executing a payload originating from the new virtual drive.
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
Page 406 of 864