Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the presence of malicious Microsoft Edge add-on IDs associated with the ShadyPanda campaign. These extensions are part of an active spyware operation affecting millions of users by exfiltrating browsing history, search queries, and other sensitive data.
Detects the presence of malicious Google Chrome extension IDs associated with the ShadyPanda campaign. These extensions can act as a backdoor, enabling remote code execution and data exfiltration.
Detects the presence of a unique build path artifact associated with the PREYHUNTER iOS spyware stager, used by the commercial surveillance vendor Intellexa.
Detects network traffic to infrastructure associated with newly identified front companies linked to the Intellexa Predator spyware syndicate.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
Detects the presence of old versions of NetSupport Manager (client32.exe), a tool repurposed as a RAT by the Bloody Wolf threat actor. The actor is known to use versions from October 2013 or older. This rule specifically looks for 'client32.exe' with the file description 'NetSupport Client' and a FileVersion older than '12.0.0.0'.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects known malicious files associated with the LANDFALL Android spyware by their SHA256 hash. This provides a high-fidelity method for identifying the presence of the spyware on an endpoint.
Detects the creation of files in a directory known to be created by a malicious NSIS installer associated with the RONINGLOADER campaign.
Detects creation of FlexibleFerret persistence mechanism via LaunchAgent plist in macOS.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects the creation of known offensive powershell scripts used for exploitation
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Detects unusual processes accessing desktop.ini, which can be leveraged to alter how Explorer displays a folder's content (i.e. renaming files) without changing them on disk.
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
Detects suspicious file writes or modifications within the 'CryptnetUrlCache' directory. Malware abuses this directory to hide payloads and configuration files, blending in with legitimate system activity.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects command-line activity aimed at discovering password manager processes or database files. This technique is often used by attackers during the reconnaissance phase to find stored credentials.
Detects the creation of a ISO file in the Outlook temp folder or in the Appdata temp folder. Typical of Qakbot TTP from end-July 2022.
Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.
Page 111 of 139