Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential CrimsonRAT backdoor binaries on Windows systems by identifying characteristic obfuscated ASISFH command tokens, embedded C2 infrastructure strings, and specific dropper file artifacts associated with Transparent Tribe (APT36).
Detects the execution of PowerShell commands by the RUSTYMOVE tool intended to enumerate external removable storage devices (USB, SD, MMC, IEEE1394). The rule monitors for the concurrent use of Get-Volume, Get-Partition, and Get-Disk cmdlets with specific BusType filtering patterns.
Detects malicious scheduled task creation using names intended to mimic Microsoft Edge update tasks. The rule identifies suspicious process activity including the spawning of conhost.exe with headless flags, PowerShell commands with encoded arguments, and attempts to fetch external scripts from the known malicious typosquatted domain indiatodays.org, all of which are characteristic of APT36 (Transparent Tribe) activity.
Detects a Golang-based remote access trojan (RAT) attributed to the Transparent Tribe (APT36) threat group. The rule identifies the malware based on distinctive fitness-themed C2 API endpoints, specific function names, hardcoded authentication secrets, and embedded Go runtime markers, while also monitoring for associated persistence registry keys and file paths.
Detects the execution of a process named 'UBP.Exe' located within a 'UBP-Asset' directory at the root of a drive. This behavior is associated with the KRSID ransomware distribution campaign, which impersonates Union Bancaire Privée to lure victims into executing the fraudulent binary.
Detects the historical HPlus HTS fraud infrastructure chain. The rule monitors for the reading of a configuration file named 'config.Ini', followed by an outbound FTP connection (port 21), and the subsequent launch of an executable, which is indicative of a Quasar RAT deployment sequence.
Detects the KRSID Rust-based ransomware binary by matching against known file hashes or by identifying specific command-line arguments and embedded file/log indicators commonly used by the malware.
Detects ISO or ZIP archive files containing a specific combination of a LNK file named 'My Resume.pdf.lnk' and a 'doxc' directory. This specific file structure is associated with Transparent Tribe (APT36) activity used to deliver malicious payloads via social engineering lures.
Detects the use of the Windows 'net' or 'net1' utility to connect to the hidden 'IPC$' inter-process communication share. This behavior is often associated with lateral movement, reconnaissance, or establishing authenticated sessions to remote systems for further malicious activity, such as remote command execution.
This rule logs the execution of 'UBPUpdater.exe'. While the purpose of this binary is not inherently malicious, tracking its execution can be useful for auditing software updates or identifying unauthorized applications running on the system.
This rule monitors network traffic to GitHub API endpoints and categorizes the activity based on APT36's known operational window (weekdays, 04:00-11:00 UTC). Traffic patterns deviating from this schedule are flagged as anomalous, helping to identify potential C2 communication outside of established threat actor activity windows.
Detects instances where a process named UBP.Exe spawns a child process named HTSPnew.Exe, specifically when both binaries reside within the same directory path containing 'UBP'. This behavior may indicate an application-specific pattern or potentially malicious execution where one component of a suite invokes another.
Detects instances where cmd.exe or wscript.exe are executed from explorer.exe or via a .lnk file, which is a common pattern for initial access and execution of malicious payloads, often seen in spearphishing scenarios involving obfuscated or disguised files.
This rule detects potential ransomware activity by monitoring for specific file naming patterns associated with known ransom notes (.krsid, README_KRSID.Txt) and the execution of suspicious processes (HTSPnew.Exe, UBPUpdater.exe).
Detects execution of processes associated with QuasarRAT or references to its configuration files, originating from or involving files and processes named 'UBPUpdater.exe' or 'UBPPatch.Psh'. Also identifies network connections via FTP or involving configuration files ('config.Ini') initiated by these specific processes, which may indicate malicious activity, command and control, or data exfiltration.
This rule detects potentially malicious file manipulation activities, such as renaming, moving, copying, or deleting files, specifically when involving targeted filenames (e.g., 'GymTraniningShedule.exe') or locations (e.g., 'SystemFolder32'). The detection monitors for suspicious command-line arguments executed by 'cmd.exe' or 'conhost.exe' and cross-references them with file deletion events involving '.lnk' files or specific application artifacts.
Detects the use of mklink.exe or cmd.exe with mklink arguments to create symbolic links associated with specific file paths (ProgramData\doxc) or specific suspicious filenames (hzwzucr_widsisa.exe). This behavior is often associated with malware persistence or evasion, where adversaries link malicious binaries to disguise their location or execution source.
This rule detects the installation or modification of ScreenConnect services on Windows endpoints. It monitors for the creation of services using 'sc.exe', process commands related to ScreenConnect setup executables, or registry modifications and service installations associated with specific ScreenConnect identifiers, often indicative of unauthorized remote management software installation.
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
Detects the Stella_Gary .NET backdoor loader used by Kimsuky/APT-C-55, identified by managed-layer reflective assembly loading strings (loader.Program.Main, AssemblyResolve callback, Stella_Gary.Program.Main)
This rule detects the execution of PowerShell commands that simultaneously perform reconnaissance for security analysis tools and virtual machine environment indicators. The presence of encoded, hidden, or non-interactive PowerShell flags in conjunction with these discovery actions is indicative of an adversary attempting to verify their execution environment to evade detection and analysis by security researchers or automated sandbox systems.
Page 372 of 1908