Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Identifies a Windows Script Host process (wscript.exe or cscript.exe) creating a JScript (.js) file in a Startup folder. This is a common persistence technique used by malware, including the JScript downloader in the Remcos RAT campaign.
Detects PowerShell commands that attempt to load a .NET assembly directly into memory using reflection. This is common in fileless malware delivery, such as the Remcos RAT campaign described in the provided intel, which uses reflection to load the final RAT stage from a steganographic JPEG, making disk-based detection ineffective.
Detects the creation of the '___unique_id___' file in a temporary directory. This file is a specific artifact used by the PeckBirdy JScript framework to store a persistent victim identifier.
Detects common shell or script processes spawned by explorer.exe, which may indicate execution via the Windows Run dialog. This behavior aligns with ClickFix social engineering techniques and checks for suspicious command-line arguments tied to this pattern, often used to download or execute malicious code.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
Detects network connections to identified command and control (C2) infrastructure for both the original TrustConnect malware and its successor, DocConnect. This rule specifically looks for connections to known suspicious domains and IP addresses associated with these malware families.
Detects file creation or process execution events involving the SHA256 hashes of malicious DLLs from the NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ NuGet packages. This rule identifies the presence or execution of known malicious components associated with a supply chain compromise targeting ASP.NET developers.
Detects when explorer.exe modifies a .lnk file immediately after a suspicious process (e.g., LOLBAS) is launched by explorer.exe on the same host. This behavior is a forensic artifact of advanced LNK spoofing techniques (Variants 3 and 4 from the referenced research) where Windows "self-repairs" an internally inconsistent shortcut file after its first execution.
This rule detects the execution of processes whose SHA256 hash matches a known hash associated with the MOONRISE RAT malware. It queries DeviceProcessEvents for the last 24 hours and filters for processes with matching SHA256 hashes.
This rule detects the execution of `nslookup` and `findstr` together in a command line, specifically looking for non-private IP addresses. This combination can indicate an adversary attempting to discover remote systems or exfiltrate data by encoding it within DNS queries, often seen in DNS tunneling or data staging activities.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
https://www.bleepingcomputer.com/news/security/new-clickfix-attack-abuses-nslookup-to-retrieve-powershell-payload-via-dns/
This rule identifies network connections to known command and control (C2) infrastructure and typosquatted domains associated with the ValleyRAT malware, specifically those used in the Huorong impersonation campaign. It looks for connections to a hardcoded malicious IP address or a list of malicious domains.
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
Detects the creation or execution of a scheduled task named 'Batteries' pointing to the AppData Roaming directory, which is a specific persistence mechanism for the ValleyRAT campaign. This rule identifies the creation of the scheduled task via 'schtasks.exe', the creation of the legacy '.job' file for the task, or the execution of the payload 'WavesSvc64.exe' from its persistence location.
Detects the execution of an executable from a subdirectory under %ProgramData% that matches the 'knz_' naming convention used by the MIMICRAT loader. MIMICRAT uses this directory to stage its Lua-based loader (zbuild.exe). The rule specifically looks for unsigned executables to reduce false positives.
Detects standalone execution of the malicious NCrypt.dll using rundll32.exe with its exported ordinal #1, a behavior observed in sandbox analysis that bypasses standard NuGet loading.
Page 450 of 509