Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Yara rule that detects StealC infostealer.
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Detects the execution of a renamed version of the "Mavinject" process. Which can be abused to perform process injection using the "/INJECTRUNNING" flag
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Adversaries may target user email on local systems to collect sensitive information.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.
Once established within a system or network, an adversary may use automated techniques for collecting internal data
Detects process injection using the signed Windows tool "Mavinject" via the "INJECTRUNNING" flag
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Adversaries may log user keystrokes to intercept credentials as the user types them.
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
Yara rule that detects MultigrainPOS infostealer.
Yara rule that detects Kangaroo ransomware.
Yara rule that detects Kovter ransomware.
Page 172 of 173