Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule detects the creation or modification of 'status.dat' or 'perf.dat' files within the 'C:\ProgramData\Microsoft\eHome' directory. The detection is specifically triggered when the process performing this file operation is either 'evteng.exe' or another process located within the 'eHome' directory, or 'libpython2.4.dll'. This activity is associated with the Evasive Panda secondary loader.
This rule detects the presence of known malicious file hashes associated with a weaponized ScreenConnect RAT campaign, specifically targeting a fake ClawdBot VS Code extension. It monitors file and process events for these specific SHA256 hashes.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
This rule detects the installation path of the Evasive Panda loader/MgBot malware. It specifically looks for file events where the target filename contains '\Microsoft\MF' within the 'ProgramData' directory. To reduce false positives, it excludes file creations by trusted system installers like 'TrustedInstaller.exe' and 'msiexec.exe' when run from 'System32'. The rule also implies that the initiating process should originate from user-space directories or the same '\Microsoft\MF' path, though this is not explicitly enforced in the final condition.
Detects deletion of eScan antivirus components, including the Remote Support Utility (tvqsapp.exe), preceded or accompanied by creation of ZIP backups in C:\ProgramData\esfsbk. This behavior may indicate malicious tampering or defense evasion associated with eScan supply chain compromise.
This rule detects network connections to known malicious IP addresses and domains, as well as the presence of files with known malicious hashes. It specifically looks for indicators associated with the Amatera Stealer, including specific domains, an IP address, and file hashes. The rule correlates network events (DeviceNetworkEvents) and file events (DeviceFileEvents) to identify these indicators of compromise (IOCs).
Detects replacement or modification of the eScan CONSCTLX.exe component located in C:\Program Files (x86)\eScan\. Replacing this binary may allow execution of a persistent next-stage payload under the guise of a trusted antivirus process.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects modification of the Windows hosts file to redirect eScan antivirus update servers (e.g., update1.mwti.net) to the non-routable IP address 2.3.4.0. This behavior prevents antivirus updates and is indicative of defense evasion or supply-chain related tampering.
Detects the creation or modification of a browser extension's manifest.json file configured to inject a script into the 'MAIN' world context of chatgpt.com. This technique allows the extension to bypass the isolated content script environment, hook native APIs like window.fetch, and steal session tokens, as seen in a campaign targeting ChatGPT users.
Detects the creation or modification of a browser extension's manifest.json file that overrides the default search provider to a known malicious or suspicious domain. This technique is used by extensions like 'DPS Websafe' and 'Stock Informer' for search hijacking.
Detects processes opening a handle to the device symbolic link '\\.\HtAntiCheatDriver'. This is the static interface for the vulnerable GameDriverX64.sys driver (CVE-2025-61155) used by the Interlock ransomware group in Bring Your Own Vulnerable Driver (BYOVD) attacks to disable security software.
Detects file activity associated with the VIMC UNITY trojan. The rule identifies two main behaviors: (1) a process running from common temporary or user data directories (Temp, AppData, ProgramData, Downloads) creating or writing to a file named 'logs.txt'; and (2) the creation of 'XClient.exe' or 'shost.exe' within Temp, AppData, or ProgramData directories. This rule can serve as a supporting indicator and should ideally be correlated with other VIMC UNITY detection rules for higher confidence.
Identifies Windows executable files signed by Hong Kong-based entities associated with IPIDEA's trojanized software distribution (e.g., masquerading as OneDriveSync or Windows Update).
Detects XenoRAT command and control information stealer file access activity. XenoRAT reads browser profile data, including logins.json, Web Data, Cookies, Local Extension Settings, chromium_plugins, and profiles.ini, as well as cryptocurrency wallet files such as _key.txt, _v20.txt, and directories under Wallets. The detection triggers when a process executing from a writable or temporary path, or matching known XenoRAT hashes including MalwareBazaar samples and the UPX packed variant bb7f5743, accesses these paths under AppData or ProgramData. For higher confidence, correlate with xenorat_execution on the same host.
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
This rule detects the presence and activity of known malicious browser extensions, specifically 'NexShield' and those associated with the 'KongTuke' campaign. It identifies these extensions by their unique IDs found in file paths or names, network connections to associated malicious IPs or domains, and specific file hashes. The rule correlates file events, network events, and process events to provide a comprehensive view of the malicious extension's activity, including when it was first and last seen, the browsers involved, and the files/folders it interacted with.
This rule detects the presence or execution of known malicious infostealer files based on their SHA256 hash values or a specific filename pattern. The SHA256 hashes are associated with infostealer malware as referenced in a VirusTotal blog post. The filename pattern 'malwarebytes-windows-github-io' also indicates potential malicious activity, likely related to a deceptive download or execution.
Detects files associated with various tools (GoTokenTheft, Earthworm, SharpHound, Impacket, GoExec, SharpWMI, Rubeus, Certipy) used by the UAT-8837 threat actor based on their SHA256 hashes.
Detects the installation of malicious browser extensions associated with the DarkSpectre threat actor, which includes the ShadyPanda, Zoom Stealer, and GhostPoster campaigns. Detection is based on known malicious extension IDs observed in file paths and registry keys for Chrome, Edge, and Firefox.
Detects when a Visual Studio Code configuration file is modified, followed by the execution of a shell or networking tool by VS Code. This pattern may indicate abuse of GitHub Copilot via prompt injection (CVE-2025-53773) to achieve remote code execution.
Page 109 of 139