Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Identifies when a Google Workspace user transfers the ownership of a file.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
This rule detects the creation or modification of email forwarding or redirection rules within Microsoft 365 audit logs. It specifically looks for operations related to 'UpdateInboxRules', 'Set-Mailbox', 'New-InboxRule', and 'Set-InboxRule' that include parameters indicative of forwarding or redirecting emails, such as 'Forward', 'Recipients', 'ForwardingSmtpAddress', 'ForwardingAddress', 'ForwardAsAttachmentTo', 'ForwardTo', 'RedirectTo', and 'RedirectToRecipients'. This activity can be a sign of an attacker attempting to exfiltrate sensitive information from a compromised mailbox or maintain persistence.
Yara rule that detects GomorrahStealer infostealer.
This rule detects the execution of 'tar.exe' with command-line arguments indicative of creating a compressed archive. Specifically, it looks for the '-c' (create), '-r' (append or update), or '-u' (update) flags. This activity is often associated with adversaries compressing data before exfiltration.
Detects the use of rar.exe to create an archive with a password and recursive flag, specifically targeting system folders or common staging directories. This behavior is often associated with attackers collecting and preparing data for exfiltration.
This rule detects the execution of 'tar.exe' with the '-x' command-line argument, indicating an attempt to extract compressed files. Adversaries often use legitimate utilities like 'tar.exe' to decompress data, which can help them avoid detection and prepare collected data for further actions like exfiltration. The rule specifically looks for the 'tar.exe' image or an original filename of 'bsdtar' combined with the extraction flag.
Detects execution of "tar.exe" in order to create a compressed file.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Adversaries may abuse various utilities to compress or encrypt data before exfiltration.
Detects execution of "tar.exe" in order to extract compressed file.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
Adversaries may abuse various utilities in order to decompress data to avoid detection.
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
Yara rule that detects OrcusRAT backdoor.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
This rule detects authentication attempts (both successful and failed) originating from a host with a 16-character alphanumeric workstation name, specifically looking for NTLM authentication. This pattern is characteristic of Metasploit's SMB modules, which often generate random 16-character workstation names during authentication attempts. The rule aims to identify potential lateral movement or reconnaissance activities using Metasploit against Windows systems.
Yara rule that detects Daolpu infostealer.
This rule detects when a user performs an eDiscovery search or exports a PST file from such a search within Microsoft 365. PST files often contain sensitive information, including email body content, making this activity a potential indicator of data exfiltration or unauthorized access to sensitive communications.
Detects when Microsoft Cloud App Security reports that an OAuth application has downloaded multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user. This activity could indicate unauthorized data exfiltration by a compromised or malicious OAuth app.
This rule detects suspicious access to the camera and microphone by processes running from unusual or temporary locations. It monitors registry events related to the CapabilityAccessManager ConsentStore for non-packaged applications. Specifically, it looks for modifications to registry keys that indicate access to 'microphone' or 'webcam' from paths like temporary folders, the Recycle Bin, or public user directories. This behavior can be indicative of malware attempting to record audio or video without user consent.
Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.
Detects potentially suspicious SQL queries executed via sqlcmd.exe targeting Veeam backup databases. The rule specifically looks for commands that attempt to query sensitive tables such as BackupRepositories, Backups, Credentials, HostCreds, SmbFileShares, Ssh_creds, and VSphereInfo, which could indicate an attempt to steal information from the Veeam backup infrastructure.
Detects the use of the 'spoolss' named pipe over SMB, which can be leveraged to trigger NTLM authentication from a target machine with the print spooler service enabled. This technique is often used in NTLM relay attacks or other forms of printer spooler abuse to gain unauthorized access or escalate privileges.
Page 166 of 173