Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects instances where a process named firefox.exe is running from a non-standard location or includes keywords indicative of keylogging activity such as 'SetWindowsHookEx', 'GetAsyncKeyState', 'GetKeyState', or 'keylog'. This is a common behavioral indicator for the BabylonRAT malware.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla Firefox program directories, a technique used by BabylonRAT and other malware to masquerade as a legitimate browser application.
Detects the creation of a scheduled task named 'Google Chrome Update' using the Windows schtasks.exe utility. The rule flags instances where the task is created from locations other than the legitimate Google Chrome installation directories, identifying potential persistence mechanisms masquerading as a common software update process.
Detects the use of PowerShell's System.Reflection.Assembly Load methods to dynamically load .NET assemblies into process memory from a byte array. This technique is often used by adversaries to execute malicious code directly in memory, bypassing disk-based detection mechanisms.
Detects the execution or loading of modules, processes, or command lines associated with the Stella_Gary C# backdoor framework. This framework is utilized by the Kimsuky (APT-C-55) threat group as part of a modular, plugin-based capability loading architecture.
Detects PowerShell command lines that perform environment validation by enumerating running processes for security software (AV/EDR/Analysis tools) and querying WMI for virtualization artifacts. This behavior is consistent with anti-analysis and anti-sandbox evasion techniques used by threat actors, such as Kimsuky, to identify and verify the execution environment before proceeding with malicious activity.
Detects files that are masquerading as Rich Text Format (RTF) documents but do not contain valid RTF magic bytes and instead contain embedded Portable Executable (PE) headers or DOS stubs. This behavior is indicative of malware delivery via file-type masquerading, often used in spearphishing campaigns by actors such as Kimsuky.
Detects unauthorized modifications to the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts). Adversaries frequently modify this file to perform DNS hijacking or domain redirection, steering users to malicious infrastructure or bypassing security controls. The rule filters out known legitimate system processes that typically interact with this file.
Detects the use of the SetWindowsHookEx API with WH_KEYBOARD_LL, which is a common technique used by malware like BabylonRAT for keylogging. The rule specifically alerts when this hook is initiated by a process masquerading as Firefox that resides outside of the legitimate installation directories.
Detects unauthorized processes attempting to access sensitive browser credential storage files belonging to Google Chrome (Login Data) and Mozilla Firefox (key4.db, logins.json). This behavior is indicative of credential harvesting often performed by infostealers like BabylonRAT.
Detects the creation of Windows Run registry keys by a process named 'firefox.exe' that originates from a non-standard file path. This behavior is indicative of BabylonRAT attempting to establish persistence by masquerading as the Mozilla Firefox browser.
Detects the presence of the modular C# backdoor framework known as Stella_Gary, used by the Kimsuky (APT-C-55) threat group. The rule identifies specific namespace and class strings associated with the framework within .NET executable files.
Detects Windows PE files exhibiting characteristics of BabylonRAT, specifically the use of dynamic API resolution via GetProcAddress and LoadLibrary to hide imports, combined with XOR-obfuscated strings for sensitive functions like CreateProcess, WriteFile, and InternetOpen to evade static analysis.
Detects the execution of 'OrionQuests-Setup.exe' followed by the creation of a shortcut (.lnk) file by the same process. This activity is a known indicator of the Kimsuky (APT-C-55) Stella_Gary infection chain, where a disguised installer drops malicious shortcuts to facilitate further execution.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Detects the execution of a process named 'firefox.exe' from a directory other than the standard Mozilla Firefox installation path ('C:\Program Files\Mozilla Firefox' or 'C:\Program Files (x86)\Mozilla Firefox'). This behavior is commonly associated with the BabylonRAT malware, which masquerades as the legitimate Firefox browser to hide its presence and facilitate initial infection.
Detects modification of the Windows HOSTS file (C:\Windows\System32\drivers\etc\hosts), which is a common technique used by malware to redirect network traffic, block access to security updates, or facilitate command and control communication.
Detects instances where a non-browser process attempts to read sensitive credential store files (e.g., 'Login Data', 'logins.json', 'key4.db') belonging to Google Chrome or Mozilla Firefox. This activity is indicative of credential harvesting often performed by malware.
Detects PowerShell scripts attempting to identify security software, virtualization environments, or sandbox analysis tools. The rule monitors for the enumeration of security processes, WMI queries for system hardware information (e.g., BIOS, Disk, Video Controller), and checks for registry keys or driver files associated with virtualization software (e.g., VMware, VirtualBox). This behavior is commonly observed in malware attempting to evade automated analysis.
Page 407 of 1908