Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
This rule detects the use of 'curl.exe' to download files from an IP address directly specified in the command line. It specifically looks for curl.exe execution, a command line containing an IP address pattern, the 'http' protocol, and common download flags such as '-O', '--remote-name', or '--output'. This activity is often associated with adversaries transferring tools or malware onto a compromised system.
This YARA rule detects the NoodRAT backdoor by identifying specific byte sequences (patterns) associated with its core functionalities. These functionalities include changing the system name, decrypting configuration data, encrypting and sending data, and receiving and decrypting data. The rule specifically targets Linux ELF executables, indicated by the magic byte `0x464C457F` at offset 0.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
Detects a network connection initiated by programs or processes running from suspicious or uncommon file system locations. This often indicates malware execution or persistence from areas not typically used by legitimate applications for network communication.
Detects the creation of file by the "node.exe" process in the ".vscode-server" directory. Could be a sign of remote file creation via VsCode tunnel feature
Detects the creation of a file with the name "code_tunnel.json" which indicate execution and usage of VsCode tunneling utility by an "Image" or "Process" other than VsCode.
Detects when a user downloads a file from an IP based URL using CertOC.exe
Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.
Detects the installation of VsCode tunnel (code-tunnel) as a service.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
This rule detects suspicious DNS queries that are characteristic of Cobalt Strike beacons. Specifically, it looks for DNS queries starting with 'aaa.stage.' or 'post.1', or containing '.stage.123456.'. These patterns are known indicators of Cobalt Strike's DNS command and control (C2) communication.
Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.
This rule detects suspicious DNS queries where the Z flag bit in the DNS protocol header is set to a non-zero value. The Z flag is reserved (unused) per IETF design, though it has recently been used in DNSSec. A non-zero Z flag value should be rare outside of legitimate DNSSec usage. The rule includes exclusions for common TLDs, query types (NS, MX), responses, and NetBIOS related traffic to reduce false positives. The rule's intent is to identify potential command and control (C2) or data exfiltration attempts leveraging DNS anomalies.
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
This rule detects the execution of well-known DNS exfiltration and tunneling tools, specifically 'iodine.exe' and 'dnscat2'. These tools are commonly used by adversaries to establish covert communication channels over DNS, allowing for data exfiltration and command and control activities that might bypass traditional network defenses.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
Detects DNS TXT records containing strings commonly used for command execution, such as 'IEX' (Invoke-Expression), 'Invoke-Expression', and 'cmd.exe'. This technique can be used by adversaries for command and control (C2) or data exfiltration by embedding commands within DNS responses.
Detects the usage of specific LDAP attributes ('primaryInternationalISDNNumber', 'otherFacsimileTelephoneNumber', 'primaryTelexNumber') that are known to be used by the LDAPFragger tool for data exchange via LDAP. These attributes are generally not commonly used in enterprise environments, making their appearance suspicious and indicative of potential Command and Control activity.
Page 283 of 296