Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,536 detections
Filters
Last updated
All Time
Detection languages
2,472
532
343
301
286
Contributors
1,303
815
737
215
193
Categories
20,443
11,831
5,875
5,151
4,864
4,536
Platforms
3,834
1,048
472
39
29
Products / Services
1,829
1,138
211
183
171
MITRE Techniques
1,599
1,417
1,297
745
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
Detects file activity associated with the LunarApplication malware, either by the known installer hash or by creation of files/directories within its installation path. This rule combines a high-fidelity hash with a specific folder path.
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
Detects the creation of JSON files within the '%LOCALAPPDATA%\Arkanix_lol\' directory. This folder is used by the Arkanix Stealer to stage stolen data before exfiltration, making this activity a strong indicator of infection.
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
Detects the creation or execution of files, often in C:\ProgramData, with a file description of 'SimpleHelp Remote Access Client' but using non-standard or renamed filenames. This is indicative of threat actors deploying the SimpleHelp RMM tool for persistence, as observed in campaigns exploiting CVE-2026-1731 in BeyondTrust.
Identifies processes that first communicate with AI services and then perform a low-volume burst of file creation or deletion events. This behavioral pattern may indicate an AI-driven ransomware or wiper attack that is surgically targeting key data to evade traditional volume-based detection methods, as theorized by Check Point Research.
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
Detects the creation of files with a .sys extension in the C:\Windows\System32\drivers\ directory that are actually portable executables (DLLs/EXEs). This is a staging technique used by the REF4033 group to deploy the BADIIS malware.
Detects file names associated with the Guloader Performance Report Pretext campaign.
Detects the creation of 'hvnc.py' in the Windows Startup folder, a persistence technique used by the Arkanix Stealer's HVNC module.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
This YARA rule set detects various artifacts associated with the Remcos RAT 'ClickFix' campaign. The rules identify persistence mechanisms (registry run keys or scripts involving 'Shotcut video editor', '2120206', and 'shotcut.exe' for DLL sideloading), archive or path indicators ('2120206' and 'shotcut.exe'), clipboard scripts used for dropping malware related to the Shotcut DLL sideloading technique.
Detects a Microsoft Office application creating script files with GUID-like names in the user's profile directory. This is the primary method used by the "Operation MacroMaze" macro to drop its initial set of malicious scripts onto the victim's machine.
This rule detects the installation and activation of the ClawdBot extension, likely within Visual Studio Code. It looks for the creation of specific files (extension.js, package.json, run.bat) within known VS Code extension paths and correlates this with the execution of 'Code.exe' or 'code.exe'. The rule specifically triggers when at least two of these files are found in the specified paths, indicating a potential extension installation.
Detects file creation in Windows Startup folders which is a common persistence mechanism used by malware. Focuses on executable file types (.exe, .scr, .bat, .cmd, .vbs, .lnk)
This rule detects the creation or modification of Chrome extension files (.crx) on a device, correlating it with browser extension installation/update events and file prevalence. It flags extensions that are rare, unsigned, small in size, or have suspicious IDs, indicating potential malicious activity or unauthorized installations.
Detects suspicious file staging activity in Temp directory structures commonly used for data exfiltration preparation. Includes credential folders, system information collection, and archive creation
Page 186 of 216