Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects the 'codesign' utility being used to extract code-signing requirements from trusted macOS system binaries. This is a key step used by malware to forge TCC permissions and inherit the privileges of trusted applications. The rule specifically looks for 'codesign' execution with '-d' and '--requirements' flags targeting common trusted binaries, initiated by scripting interpreters.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
This query detects attempts to disable or modify critical security services using either the 'sc.exe' utility or direct registry modification. This is a common defense evasion technique used by adversaries to weaken a system's security posture before performing further actions.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the execution of SyncAppvPublishingServer.vbs with a command line containing a semicolon, which is indicative of the ClearFake malware campaign's ClickFix technique. This technique abuses SyncAppvPublishingServer.vbs to proxy execution of malicious PowerShell commands, often delivered via social engineering involving malicious copy-paste actions.
Detects network connections to domains associated with the DarkSpectre threat actor's campaigns, including GhostPoster, ShadyPanda, and The Zoom Stealer. These campaigns leverage malicious browser extensions for data theft, affiliate fraud, and corporate espionage.
Detects execution of TruffleHog, an open-source tool used to search repositories, files, and environments for secrets and credentials. Adversaries may use it to discover exposed credentials or sensitive information within source code or configuration files
Detects the execution of a custom EDR bypass tool (AVB.exe or AVMon.exe) used by the Crypto24 ransomware group. This tool is a variant of RealBlindingEDR and is used to disable security products.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
Detects the silent installation and configuration of AnyDesk from the command line. This technique was observed being used by actors deploying DeadLock ransomware to establish persistence.
Detects potential WARP PANDA Junction implant activity by identifying processes, other than the legitimate 'vvold' service, listening on TCP port 8090. The Junction implant uses this port to masquerade and receive commands.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
This rule detects the creation or modification of a GitHub Actions workflow file named 'discussion.yaml' within the '.github/workflows/' directory. This is a known persistence technique used by the Shai-Hulud 2.0 worm to register an infected machine as a self-hosted runner, allowing attackers to execute arbitrary commands.
This rule detects the creation or modification of files associated with the Shai-Hulud 2.0 worm. The detection is based on specific file hashes and a behavioral rule for an unusually large 'bun_environment.js' file, which is a key indicator of the malware's obfuscation techniques.
Detects a process accessing multiple files related to known cryptocurrency wallets or browser extensions. This behavior is indicative of information stealers like LeakyStealer attempting to exfiltrate sensitive wallet data.
Page 67 of 100