Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.
Detects the loading of avicap32.dll by non-conferencing processes executing from user-writable directories such as AppData or Temp. This behavior is indicative of Remcos RAT or similar remote access trojans attempting to covertly capture audio or video using Windows API modules commonly used for media capture.
Detects the creation of a 'keylogger.dat' file in common writable directories (AppData, Temp, ProgramData) by non-standard system processes. This is a behavioral indicator commonly associated with the Remcos Remote Access Trojan (RAT), which uses low-level keyboard hooks to capture input and save the data to a local file for exfiltration.
This rule detects the use of PowerShell commands that leverage Windows Forms or GDI APIs (e.g., System.Windows.Forms.Screen, System.Drawing.Bitmap, CopyFromScreen) to perform screen capture. Adversaries often use these native .NET capabilities to capture desktop screenshots during post-exploitation.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects successful authentication to Atlassian Jira from an anomalous network source (e.g., proxied or unusual geolocation/ASN) following a period of credential inactivity. This activity is consistent with tactics used by the HellCat ransomware group, who leverage credentials harvested by infostealers (such as Raccoon, Redline, StealC, or Lumma) to gain initial unauthorized access to corporate Jira environments.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects command-line activity containing keywords related to API hooking (e.g., SetWindowsHookEx, hook, inline, trampoline) initiated by common scripting interpreters like powershell.exe, cmd.exe, or rundll32.exe. This pattern is often associated with malware attempting to inject code or capture data by intercepting process function calls.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
This rule detects two distinct but related network-based adversary-in-the-middle (AiTM) techniques. The first part identifies ARP spoofing by looking for the same IP address being claimed by multiple MAC addresses within a short time frame, which can indicate an attacker is attempting to intercept local network traffic. The second part detects TLS certificate pinning failures, which can occur when an attacker attempts to perform a man-in-the-middle attack by presenting an untrusted or modified TLS certificate to a client that expects a specific certificate (pinning). This is often indicative of an attempt to intercept or decrypt encrypted network communications.
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
Detects Millenium RAT (or similar malware associated with the Y2K Operators campaign) writing keystroke capture files to user APPDATA directories. The rule specifically monitors file creation events by non-browser/non-UI processes that utilize suspicious file extensions (.g0, .txt, .log, .dat).
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
Detects the creation of image files (e.g., .bmp, .png, .jpg) in temporary or specific working directories by processes associated with BeepRAT (HFY.exe, tcc.exe, LuaJit.exe). This activity is indicative of the RAT executing screen capture commands to exfiltrate desktop imagery.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects Python processes attempting to read sensitive credential files (Login Data, Cookies, logins.json, key4.db) from Chrome, Firefox, and Edge directories. This behavior is indicative of the InvisibleFerret infostealer, which targets browser-stored credentials on compromised developer workstations.
Detects Python-based processes accessing sensitive local cryptocurrency wallet files and directories, including MetaMask extension storage, Exodus wallet, and Bitcoin wallet files, which are known targets of the InvisibleFerret infostealer.
Page 94 of 173