Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This detection looks for browser network traffic to URLs containing common social engineering keywords and common web page file extensions, while excluding trusted domains. This activity is associated with the Matrix Push C2 framework, which uses malicious browser notifications to lure users to phishing pages.
Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.
Detects the creation or modification of files with SHA256 hashes known to be associated with the Shai-Hulud 2.0 npm supply chain attack campaign. This rule specifically looks for file creation or renaming events where the SHA256 hash of the file matches a predefined list of malicious hashes.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
This rule detects instances where 'regedit.exe' is launched by a parent process that is not commonly associated with its execution. It specifically filters out common legitimate parent processes like 'explorer.exe', 'msiexec.exe', and 'cmd.exe', and also excludes parent processes originating from standard Windows and Program Files directories. This helps to identify suspicious or unauthorized attempts to modify the Windows Registry.
This query identifies an anomalous pattern associated with behavior performed by Sha1-Hulud to perform initial access, connect to C2, and establish persistence. Ref: https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
KQL Query from file: ConvertMate - suspicious PDF editor
This query identifies an anomalous pattern associated with behavior performed by NotDoor to establish persistence and avoid its detection.
Detects host-based artifacts associated with AK47/X2ANYLOCK ransomware, such as the creation of specific ransom notes ('How to decrypt my data.txt', 'How to decrypt my data.log') or files being encrypted with the '.x2anylock' extension. This rule identifies both the creation of the ransom note and the encryption of files by monitoring file creation and renaming events.
Detects the download of a Java Archive (JAR) file initiated by a document reader, browser, or email client. This behavior is consistent with the Bloody Wolf threat actor, which uses spear-phishing to trick users into downloading malicious JAR loaders for the NetSupport RAT.
This detection identifies Command and Control (C2) communication associated with the FormBook RAT, specifically targeting connections to a known malicious IP address and dynamic DNS domain on an unusual port. Detecting C2 activity is crucial for identifying active compromises and preventing data exfiltration or further malicious commands.
Detects Remote Procedure Call (RPC) attempts targeting critical assets, such as Domain Controllers, where the call includes a UNC path pointing to an external IP address. This is a strong indicator of an authentication coercion attack (e.g., PetitPotam, DFSCoerce) where an attacker is attempting to force the critical asset to authenticate to a listener they control to capture credentials.
Detects the presence of old versions of NetSupport Manager (client32.exe), a tool repurposed as a RAT by the Bloody Wolf threat actor. The actor is known to use versions from October 2013 or older. This rule specifically looks for 'client32.exe' with the file description 'NetSupport Client' and a FileVersion older than '12.0.0.0'.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects network connections from Samsung Android devices that match the Command and Control (C2) patterns of the LANDFALL spyware. The rule identifies high-fidelity connections to known LANDFALL C2 IPs and domains, as well as lower-fidelity behavioral patterns, such as connections over HTTPS to non-standard ports.
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, Tycoon2FA.
Detects the creation or loading of the LANDFALL spyware's SELinux policy manipulator component (`l.so`). This component is used to gain elevated permissions and persistence on compromised Samsung Android devices. The rule identifies the component by its known hash or by its specific file name and path (`/data/data/com.samsung.ipservice/files/l.so`).
Page 461 of 509