Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,057 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,110
9,757
3,852
3,759
3,713
Platforms
40,057
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,879
MITRE Techniques
13,737
13,117
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects a two-stage pattern indicative of command-and-control (C2) communication. The rule identifies an initial request to a 'relays.json' endpoint (relay discovery) followed by a request to an 'api.php' endpoint (dispatcher decision) within a 5-second window, both using a 13-digit timestamp query string for cache-busting. It also captures single-stage 'api.php' requests as lower confidence alerts.
Matches known SilverFox malware payload samples by SHA256 hash
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule detects the sequence of an external file download over HTTP, followed by the immediate creation and execution of an executable file (.exe, .dll, .scr) on the endpoint. It specifically filters out common system installers (e.g., msiexec.exe, trustedinstaller.exe) to reduce noise, focusing on potentially malicious payloads delivered via network channels.
Detects process creation events containing command-line arguments indicative of an OAuth 2.0 device code flow, commonly used in consent phishing or device code phishing attacks to hijack account access via a malicious OAuth application registration.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Detects executable files containing XOR-obfuscated strings associated with BabylonRAT capabilities, including browser credential theft, keylogging, HOSTS file manipulation, DDoS, and remote dynamic API resolution. This rule identifies patterns commonly used to evade static analysis.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects the creation or registration of scheduled tasks that masquerade as Google Chrome updates but point to non-standard executable paths. This is a common technique used by malware to establish persistence by mimicking legitimate software update tasks.
This rule detects PowerShell commands that enumerate system, security, or virtualization-related artifacts. It specifically looks for the usage of WMI and PowerShell cmdlets (e.g., Get-Process, Get-WmiObject) to query for known analysis tools, debuggers, or virtualization software strings, which is a common behavior of malware attempting to identify and evade sandbox or analyst environments.
Detects the creation of scheduled tasks that contain the string 'Google Chrome Update' in the command line, but are not associated with the legitimate GoogleUpdate.exe binary. This is a common technique used by malware to establish persistence by masquerading as a legitimate update process.
This rule detects potential BabylonRAT malware samples by identifying a combination of dynamic API resolution techniques (using GetProcAddress and LoadLibrary) and XOR-obfuscated string blocks representing critical DLL and API names. The detection utilizes high file entropy and specific artifact strings to identify binaries attempting to evade static analysis.
Detects the creation of a Windows scheduled task named 'Google Chrome Update' where the command-line action does not point to the legitimate GoogleUpdate.exe binary. This behavior is indicative of persistence mechanisms used by threat actors, notably the Kimsuky group, to masquerade malicious tasks as legitimate software updaters.
Detects persistence mechanisms associated with BabylonRAT that utilize Windows Registry Run or RunOnce keys. The rule specifically identifies instances where a file named 'firefox.exe' is executed from the 'ProgramData' directory, which is a common indicator of a masqueraded malicious binary attempting to achieve persistence.
This rule detects PowerShell commands or script blocks that enumerate running processes and query WMI/CIM classes (such as Win32_ComputerSystem or Win32_BIOS) to identify indicators of virtualization, sandboxing, or the presence of security analysis tools. This behavior is indicative of anti-analysis and sandbox-evasion techniques, commonly used by threat actors like Kimsuky to verify their execution environment before proceeding with malicious activity.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network communication with Google Sheets API endpoints that contain specific indicators of C2 behavior, such as suspicious User-Agents, specific spreadsheet cell references, or input options characteristic of automated data exfiltration or command retrieval.
Page 370 of 1908