Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
This rule detects large internal data transfers within the home network, specifically looking for TCP traffic with a data size greater than 65000 bytes. It triggers an alert if more than 50 such transfers occur from a single source within a 60-second window. This behavior is indicative of data staging, where an adversary might be collecting and consolidating data prior to exfiltration.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories. This activity is indicative of data staging or exfiltration, specifically linked to the 'protocal.cjs' backdoor from the 'easy-day-js' supply chain attack.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.
Detects the same authentication session or token identifier used from geographically inconsistent locations within a short period. This could indicate session hijacking or an adversary using a compromised session from a different location.
Detects a single new session identifier accessing Exchange, SharePoint, and OneDrive within a short period, which may indicate broad post-authentication collection following an adversary-in-the-middle (AiTM) attack.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects the installation of low-level keyboard hooks (WH_KEYBOARD_LL or WH_KEYBOARD) using API calls. It specifically monitors for processes attempting to hook keyboard input from user-writable directories (e.g., Temp, Downloads, AppData) or using unsigned/invalidly signed binaries, which is a common technique used by malware like keyloggers for credential theft.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects a newly replayed session issuing mailbox searches for invoice, payment, password, security, or confidential terms. This rule is designed to identify suspicious activity indicative of session hijacking or credential compromise, where an attacker uses a replayed session to search for sensitive information within a mailbox or SharePoint.
Detects unauthorized processes attempting to read, modify, or create files within common browser credential locations (Chrome, Firefox, Edge, and Windows Credential Manager). Legitimate browser processes and their known signers are excluded, focusing on suspicious secondary processes or tools frequently utilized by infostealers like Lumma and RedLine to dump credentials.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects unauthorized access (File Creation, Modification, Rename, or Deletion) to common web browser cookie and credential storage files by non-browser processes. This behavior is a common indicator of information-stealing malware attempting to extract session cookies and credentials for later use.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
This rule detects execution patterns associated with the BeepRAT malware family. It identifies the presence of known loaders (HFY.exe or tcc.exe) or processes exhibiting specific command-line arguments and configuration loading behavior often used by this malware. The rule also aims to identify child process activity consistent with keyboard hooking.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
Detects command-line execution or file events indicative of BeepRAT C2 framework activity, specifically targeting screen capture and thumbnail streaming commands derived from DcRAT plugin behavior.
Detects activity associated with the BeepRAT keylogger plugin by monitoring for specific command-line strings and file artifacts identified in the DcRAT-derived BeepRAT framework.
Page 106 of 173