Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,122 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,122
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the execution of multiple distinct commands used to inhibit system recovery on a single host within a short time window. This behavior is a strong indicator of ransomware or other destructive malware attempting to prevent system restoration.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects the execution of specific Asterisk CLI commands, often associated with reconnaissance or resource hijacking, by non-interactive or web server accounts. This behavior is a key indicator of the EncystPHP web shell abusing PBX functionality for activities like toll fraud.
This rule detects network connections to known cryptocurrency mining pools or processes associated with cryptocurrency mining. It identifies suspicious activity based on remote URLs, process names, and remote ports commonly used by miners.
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
The rule detects the creation of specific mutexes associated with the Beast ransomware. It looks for mutex names 'BEAST HERE?'. This activity is indicative of the Beast ransomware executing on a Windows system, likely as part of its encryption or operational phases.
Detects web navigation to Amazon and AliExpress that contains specific hardcoded affiliate tags used by the 10xprofit extension network. The presence of these tags indicates active affiliate hijacking, likely due to a malicious browser extension.
The rule detects the creation of specific mutexes ('tech') that are known to be associated with Hermes ransomware activity. This detection is based on monitoring process creation events for these mutex names.
This rule detects the creation of a specific mutex named 'DoYouWantToHaveSexWithCuongDong'. This mutex name is known to be associated with Babuk ransomware activity. The detection is based on monitoring process creation events on Windows systems for the presence of this particular mutex.
The rule detects the presence of specific mutex names ('PAYDAYDAYPAY') that are known to be associated with BTCWare ransomware activity. This detection is based on process creation events where these mutexes are observed.
The rule detects the creation of specific mutexes known to be associated with Scarabey ransomware. The detection is triggered when a process creates a mutex with the name 'STOPSCARABSTOPSCARABSTOPSCARABSTOPSCARABSTOPSCARAB'.
Detects known mutexes associated with DireWolf ransomware activity. Specifically, it looks for the mutex named 'Global\direwolfAppMutex'.
The rule detects the creation of specific mutex names ('m23071644') associated with Makop ransomware activity. It monitors process creation events on Windows systems for these mutexes, indicating potential ransomware infection or execution.
The rule detects the creation of specific mutexes known to be associated with the Gunra ransomware. It looks for the mutex name 'kjsidugiaadf99439' during process creation events on Windows systems. The presence of this mutex indicates potential Gunra ransomware activity, which typically involves encrypting files and demanding a ransom, falling under the impact category of data encryption.
This rule detects the creation of specific mutexes associated with the DarkAngels ransomware. The detection is based on the presence of the mutex name 'DarkAngels'. The rule aims to identify potential DarkAngels ransomware activity on Windows systems by monitoring process creation events for these mutexes.
This rule identifies the creation or deletion of user accounts in Azure AD (Entra ID) by principals not on an approved list. It relies on a customized list of approved administrators/service principals to reduce false positives.
This rule detects the creation of specific mutex names associated with Zola ransomware activity. The detection is based on the presence of the mutex '4B991369-7C7C-47AA-A81E-EF6ED1F5E24C'. The rule monitors process creation events on Windows systems to identify these mutexes, which are indicators of Zola ransomware execution or presence.
The rule detects the creation of specific mutexes associated with ZCryptor ransomware activity. It specifically looks for a mutex named 'zcrypt1.0'. The detection is based on process creation logs from Windows systems.
The rule detects the creation of specific mutex names associated with Nitrogen ransomware activity. It specifically looks for the mutex 'nvxkjcv7yxctvgsdfjhv6esdvsx'. This indicates the presence or execution of the Nitrogen ransomware on a Windows system.
The rule detects the creation of a specific mutex named 'dawdhahdaw'. This mutex name is associated with d0glun ransomware activity. The detection is based on monitoring process creation events on Windows systems.
This rule detects the creation of specific mutexes known to be associated with Cl0p ransomware activity. The detection is based on a predefined list of unique mutex names that Cl0p ransomware has been observed to use. The rule triggers when any of these mutex names are identified during process creation events on Windows systems.
Page 87 of 149