Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Well-known TAP software installation. Possible preparation for data exfiltration using tunnelling techniques
Detects DNS queries for "anonfiles.com", which is an anonymous file upload platform often used for malicious purposes
Detects DNS queries for subdomains related to MEGA sharing website
Detects Rclone config files being created
Detects potential exfiltration attempt via audio file using PowerShell
Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
Well-known DNS Exfiltration tools execution
Detects the execution of "ldifde.exe" in order to export organizational Active Directory structure.
Detects email exfiltration via powershell cmdlets
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie".
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.
Detects a suspicious output redirection to the local admins share, this technique is often found in malicious scripts or hacktool stagers
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Yara rule that detects Konni backdoor.
Yara rule that detects LumarStealer infostealer.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WinWord64 ransomware by identifying specific byte patterns related to remote connections, file encryption routines, and file discovery mechanisms. The rule looks for a combination of these patterns within a PE file (indicated by 'uint16(0) == 0x5A4D' for 'MZ' header). The 'remote_connection_p*' strings suggest network communication capabilities, while 'encrypt_files_p*' strings indicate file encryption functionality, and 'find_files' points to file enumeration or discovery.
This YARA rule detects the Sifreli ransomware by identifying specific byte patterns related to file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to classify it as Sifreli ransomware.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
Page 123 of 124