Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
462 detections
Filters
Last updated
All Time
Detection languages
298
91
19
18
17
Contributors
217
125
23
14
13
Categories
198
167
67
55
51
Platforms
363
165
83
10
7
Products / Services
10,665
9,773
6,705
4,421
3,749
462
MITRE Techniques
201
124
113
80
47
CVEs
4
3
3
2
1
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
This rule detects various stages of the CastleLoader malware activity, including C2 communication, process hollowing using AutoIt and jsc.exe, and known malware hashes. It correlates network traffic to a specific C2 server, identifies suspicious process creation patterns where AutoIt launches jsc.exe, and sweeps for known SHA256 hashes associated with CastleLoader.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
This rule detects activity associated with the RenEngine campaign, which utilizes HijackLoader to deliver Lumma Stealer and ACR Stealer. It identifies malicious activity through three main methods: 1) Endpoint detection of known MD5 hashes associated with the malware, 2) Network traffic (proxy/DNS/netflow) to distribution sites used by the campaign, and 3) Network traffic (proxy/DNS/netflow) to known Lumma Stealer C2 domains.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects a multi-stage attack chain associated with BQTLock and GREENBLOOD ransomware. It identifies the staging of registry keys for a fodhelper UAC bypass, the subsequent execution of fodhelper.exe, the creation of run-key persistence, and the execution of processes containing the keyword 'greenblood' in their command line, indicating the final payload or related activity.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects the silent installation and configuration of AnyDesk from the command line. This technique was observed being used by actors deploying DeadLock ransomware to establish persistence.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Page 11 of 22