Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the loading of graphics-related DLLs (gdiplus.dll, gdi32.dll, gdi32full.dll) by processes executing from typically writable directories such as Temp, AppData, or ProgramData. This behavior is consistent with the screen capture functionality of the JFMBackdoor (Red Lamassu), which utilizes these libraries to capture, encode, and stage screen images.
Detects the creation or modification of files within the 'C:\ProgramData\Windows Multimedia' directory, a path associated with JFMBackdoor's screen capture output. The rule specifically monitors for this activity when initiated by 'fltMC.exe', which is known to be used by this malware for DLL side-loading.
Detects clipboard access operations (Read/Write) initiated by common web browsers (Chrome, Edge, Brave, Electron-based apps) when running with specific command-line arguments typically associated with renderer or extension processes. This can indicate malicious code or browser extensions attempting to monitor or steal sensitive clipboard content.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects read access to cryptocurrency wallet files and application directories (including Electrum, Exodus, Atomic, and generic wallet.dat files) by non-wallet associated processes. This behavior is consistent with credential harvesting activities by info-stealing malware such as StealC.
Detects the use of screen capture utilities such as ffmpeg, grim, scrot, or xwd, which are often used by the MYRA RAT to capture live desktop sessions for exfiltration.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects a potential storage container hijacking attack in Azure, where a container is deleted in one subscription and subsequently recreated with the same name in a different subscription within the same tenant. This sequence can be used to redirect data streams or intercept access to containerized resources.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects file operations (creation, modification, deletion, renaming) involving common SSH key files (id_rsa, id_ed25519) or files located within .ssh directories, initiated by processes typically associated with AI/LLM tools (chatgpt, perplexity, etc.) or generic process names. This may indicate an attempt to exfiltrate or manipulate authentication credentials by unauthorized applications.
Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.
Detects the presence of Remcos RAT by correlating a specific mutex (Remcos_Mutex_Inj) indicative of active malicious processes with an outbound network connection to a known command-and-control (C2) IP address (62.102.148.212) on port 37393. This combination is characteristic of Remcos RAT operations used for unauthorized audio and webcam surveillance.
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
This rule detects the execution of common Impacket toolkit utilities, such as ntlmrelayx.py and smbserver.py, via process command line arguments. These tools are frequently used by adversaries for relay attacks, remote service execution, and credential harvesting.
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Detects process activity indicative of keylogging by the Remcos RAT loader. The rule specifically looks for processes with 'Remcos' or 'GST*.com' in their file name that also contain command-line arguments related to capturing window text or foreground window information, which are common keylogger behaviors.
This rule detects suspicious activities indicative of Phantom Stealer malware injecting into 'explorer.exe'. It looks for screen capture API calls originating from 'explorer.exe', the loading of GDI DLLs into 'explorer.exe', and 'explorer.exe' being spawned from unexpected parent processes, all of which are behaviors associated with Phantom Stealer.
This rule detects attempts by processes located outside of standard system directories (C:\Windows, C:\Program Files) but within user or program data directories (C:\Users, C:\ProgramData, C:\AppData) to access clipboard data. This could indicate malicious activity where an unauthorized application is trying to exfiltrate sensitive information from the clipboard.
Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.
This rule detects potential unauthorized access to Azure Storage Blobs following the retrieval of storage account access keys. It correlates 'ListKeys' API events with subsequent blob access activities from either unrecognized IP addresses or via Shared Access Signature (SAS) tokens, indicating potential credential misuse.
Detects the execution of the WinRAR archival utility ('rar.exe') using specific command-line flags associated with creating password-protected or encrypted archives. This behavior is often indicative of data staging and collection for exfiltration purposes.
Page 103 of 173