Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule correlates the creation of a potentially executable or script file by a browser or Microsoft Office application with its subsequent execution within a short time frame. This pattern is highly indicative of a user being tricked into downloading and running a malicious payload, often associated with initial access techniques like spearphishing with malicious attachments.
Detects the creation of DLL files in the `C:\Windows\System32` or `C:\Windows\SysWOW64` directories by processes that are not themselves located in these system directories. This behavior can indicate DLL planting, a technique used for persistence, privilege escalation, or defense evasion, often associated with DLL search order hijacking or side-loading. The rule excludes known legitimate activities such as printer driver installations and specific noisy legitimate software processes.
Attackers do not only use emojis in the subject. Sometimes they also use them in the file name itself to make the file look more attractive or legitimate. Based on my experience, I am not expecting legitimate files names with icons so it can be an interesting case to easily convert the hunting into a detection. For example:
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on disk
- Files downloaded from phishing emails
- User-downloaded scam files
- Payloads with social engineering names
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on disk
- Files downloaded from phishing emails
- User-downloaded scam files
- Payloads with social engineering names
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
Detects the creation of HTML files with specific formatting tags used by the SlimAgent keylogger, a tool used by Sednit (APT28).
Detects the creation or modification of "app.asar" files, which are archives used by Electron-based applications. Adversaries can replace this file in a legitimate, signed application to execute malicious code, as seen in a recent ClickFix campaign trojanizing the WorkFlowy application.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
This rule detects files associated with two distinct malware chains, ShellFolder and LOTUSLITE, which have been observed in campaigns leveraging Middle East conflict themes as bait. The ShellFolder chain detection focuses on specific file names like 'ShellFolder.exe', 'ShellFolderDepend.dll', and 'BaiNetdisk', along with a unique decryption key '20260301@@@'. The LOTUSLITE downloader chain detection identifies specific DLLs ('libmemobook.dll', 'kugou.dll'), folder paths ('C:\ProgramData\CClipboardCm\', 'C:\ProgramData\WebFeatures\'), executable names ('WebFeatures.exe'), and hardcoded URLs/IP addresses ('www.e-kflower.com', '172.81.60.97') used for persistence and downloading next-stage malware. The rule aims to identify concrete indicators of compromise rather than broad patterns, focusing on the specific artifacts reported in related threat intelligence.
Detects the creation of the "C:\Nintendo" directory, which is a hardcoded developer backdoor used by the HellsUchecker malware to bypass anti-sandbox and anti-analysis checks.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
Detects the creation of specific file artifacts used by the DeadVax loader as staging containers for encrypted payloads. The malware uses `rEgX.cmd` as a self-copy, `windows.dll` as a temporary text file to hold a Base64 payload, and `boot64x.w` to store the final shellcode.
Detects malicious Message of the Day scripts for persistence
The first rule, VoidGeist_Batch_Orchestrator, detects a multi-stage Python loader associated with the VoidGeist malware. It looks for specific filenames like 'non.bat', 'spol.bat', 'python-3.10.0-embed-amd64.zip', and various '.bin' and '.json' files, along with the domain 'trycloudflare.com' or the string 'status=success'. The rule also requires at least two of the '.bin' or '.json' files to be present and the overall file size to be less than 250KB. The second rule, VoidGeist_EarlyBird_APC, targets a PE or helper implant used by VoidGeist. It identifies Portable Executable (PE) files that import specific functions from 'kernel32.dll' such as 'CreateProcessA', 'VirtualAllocEx', and 'WriteProcessMemory'. Additionally, it looks for the string 'explorer.exe' and at least two of the following
description =
description =
Detects the creation of files with the '.waiting' or '.wait' extension, which are appended by Crytox ransomware to encrypted files. This rule specifically looks for file creation events where the filename ends with these characteristic extensions, indicating potential ransomware activity.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
This rule detects the creation of specific batch files ("non.bat" or "spol.bat") within the Windows Startup folder (`\Microsoft\Windows\Start Menu\Programs\Startup`). This activity is indicative of persistence, as files placed in this location will execute automatically when a user logs in, potentially associated with the VoidGeist malware chain.
Detects scripts modifying Windows registry run keys for establishing persistence
Page 183 of 216