Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the addition of a 'DailyFitnessTracker' entry to the HKCU Windows Registry Run key, which is a technique used by Golang-based RATs to establish persistence. The rule monitors both 'reg.exe' command-line operations and PowerShell 'New-ItemProperty' cmdlets targeting this specific registry path.
Detects the execution of a file with a '.Psh' extension named 'UBPPatch.Psh' that is launched by the process 'UBPUpdater.Exe'. This behavior is indicative of a masqueraded script execution where a suspicious binary or script is disguised with an unconventional extension to evade standard detection mechanisms.
Detects malicious activity involving the HTS software update mechanism, where the legitimate updater or patch processes are leveraged to download and execute the HTSPnew.exe ransomware payload.
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
Detects a specific loader sequence associated with the DarkMe malware/Water Hydra threat actor. The rule monitors for the execution of rundll32.exe with the /sta flag and a specific CLSID, followed by the presence or execution of targeted applications (cryptocurrency wallets, password managers, and system utilities) within a 15-minute timeframe. This sequence is indicative of the malware enumerating potential targets on the infected host before proceeding with malicious activity.
Detects execution of the Go runtime invoking a local module ('go run .') initiated by infrastructure-as-code tools like Terraform or standard command-line interpreters. This pattern matches the behavior of the Graphalgo RAT, which uses a hash-gated mechanism within malicious modules to trigger a second-stage payload.
Detects instances where a Terraform provider process spawns a child process (go.exe or cmd.exe) to execute 'go run .'. This behavior is atypical for standard Terraform provider execution and may indicate the use of malicious providers that compile and execute code on-the-fly, a technique used to evade signature-based detection.
Detects the execution of package management commands (npm, pip, python) within directories or command-line arguments containing 'veltrix' or 'veltrix-capital', which may indicate the use of malicious dependencies or cloned repository lures.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
Detects potential manual paste-and-run execution patterns where a shell or interpreter is launched directly from Windows Explorer (e.g., via the Run dialog or manual clipboard paste), correlated with either command-line references to or outbound network connections towards Cloudflare Tunnel services (trycloudflare.com, workers.dev). The rule specifically identifies one-off execution events by excluding cases where explorer.exe spawns multiple child processes simultaneously, indicating non-routine shell behavior.
This rule detects the presence of files matching known SHA256 hashes associated with the GhostCode phishing kit. It monitors for these files both in email attachments and on local device filesystems to identify potential delivery and execution of malicious phishing payloads.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Detects execution of shell commands (cmd, powershell) by processes associated with AvisLoader (e.g., 78324.exe, VLCAssistant.exe, auto.exe), followed by the creation or modification of files in suspicious user-writable directories (e.g., appdata, temp) within a 10-minute window, suggesting potential C2 activity and secondary payload staging.
Matches known SHA-256 hashes of AvisLoader toolkit components recovered from an exposed staging server: the Windows loader client, UAC-bypass helper, and process-hiding DLL
Detects AvisLoader Windows loader requiring both decoy non-executable packer-named sections and an embedded c-toxcore developer build path to co-occur in a valid PE
Detects AvisLoader Windows loader requiring both decoy non-executable packer-named sections and an embedded c-toxcore developer build path to co-occur in a valid PE
Detects the execution of the KRSID ransomware binary, which is written in Rust. The rule identifies the malware based on its unique file extensions, ransom note filenames, specific command-line arguments, log file indicators, and compiled code characteristics.
Page 236 of 1908