Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where processes other than the legitimate Telegram Desktop application or its updater attempt to access files within the Telegram Desktop 'tdata' directory. This directory contains session information, which can be harvested by malicious actors to hijack user sessions or access sensitive information.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
Detects network communication to known MovieReaper C2 infrastructure (deadhub.org or 193.23.118.155) originating from a masqueraded 'msedge.exe' process located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicating potential C2 check-ins or data exfiltration by the file manager module.
Detects the use of the undocumented NTAPI function EtwpCreateEtwThread within a thread creation call trace. This function is often abused by shellcode loaders to execute malicious code within a target process while attempting to evade standard EDR detection mechanisms.
Detects the execution of the MovieReaper malware loader, which masquerades as 'msedge.exe' within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This technique is used to bypass anti-sandbox checks by respawning as a legitimate-looking process in a persistent location after initial environment analysis is completed.
Detects the execution of processes with suspicious file names that are commonly associated with masquerading, potentially impersonating legitimate software or system tools.
Detects when common torrent client applications spawn a child process that is an executable. This behavior is often associated with the execution of malicious payloads delivered or masqueraded as files within torrent environments.
Detects the execution of suspicious executables spawned from common torrent client applications. This rule monitors for known malicious file hashes or processes launched by torrent clients with suspicious naming patterns typically associated with pirated software or malware masquerading as media files (e.g., tags like 1080p, x264, bluray in executable names).
Detects the use of PowerShell to modify Microsoft Defender (MpPreference) settings by adding specific directories or files to the exclusion list. This behavior is frequently associated with adversaries attempting to evade security detection by ensuring malicious tools, staged payloads, or persistent files remain unscanned by the antivirus engine.
Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.
Detects artifacts associated with the CRUDEEXCLUDE Delphi-based loader, which is used to deploy the HEAVYGRAM backdoor. The rule identifies a combination of Delphi indicators, anti-analysis sandbox connectivity checks, decoy message boxes, and attempts to modify Windows Defender exclusions for specific paths associated with the malware's activity.
Detects the execution of PowerShell commands using 'Add-MpPreference -ExclusionPath' initiated by the CRUDEEXCLUDE Delphi utility. This behavior is associated with threat actors staging directories for the deployment of HEAVYGRAM/SHADEGENES payloads.
Detects the execution of known malicious loader files associated with the MovieReaper campaign. The rule identifies processes based on specific MD5 hashes, or by detecting obfuscated naming conventions where an executable file is disguised as a movie file by appending excessive padding or specific descriptors to the filename, often used to bypass user suspicion when distributed via torrent repositories.
Detects a suspicious sequence of PowerShell commands associated with HEAVYGRAM-related droppers. The rule identifies processes that attempt to bypass security protections by adding Windows Defender exclusion paths, followed by registry-based persistence mechanisms (Run keys) that target common malicious executables such as RuntimeSSH.exe or winappx.exe.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
Detects the initialization of COFF object files within a process memory context, characteristic of the MovieReaper stage-2 implant. This rule identifies the invocation of a 'module_init' exported function, which serves as a common mechanism for executing Beacon Object Files (BOF) or similar in-memory command loading interfaces.
HBO Max ClickFix attacks IOC Hunt
Cortex XDR
Detects network activity (DNS queries or direct IP communication) associated with 'ClickFix' social engineering attacks targeting users under the guise of an HBO Max update or repair utility. The rule includes indicators for known malicious domains and IP addresses while incorporating filters to minimize false positives from security scanners, threat intel feeds, and automated crawlers by analyzing User-Agent strings and network source addresses.
Detects instances where a Visual Studio Code (VS Code) extension host process launches potentially suspicious child processes, specifically command-line tools like cmd.exe, powershell.exe, or calc.exe, within 30 seconds of the extension host starting.
This rule detects potentially malicious activity originating from code editors (VS Code, Electron-based applications) spawning suspicious child processes (cmd.exe, powershell.exe, calc.exe) or the creation of a specific suspicious file 'EXTINSTALL_PWNED.txt' in the 'Users\Public' directory.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Page 337 of 1908