Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,456
11,839
5,876
5,155
4,865
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
This rule monitors for indicators of compromise (IOCs) associated with the threat actor SideCopy and their associated malware, such as ReverseRAT. It hunts for specific malicious SHA256 file/process hashes, connections to known malicious C2 infrastructure (IPs and domains), requests to known malicious URLs, and user interaction with these URLs via email clicks.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects the execution of binaries masquerading as legitimate software (such as KeePass, Adobe Flash, or specialized medical document viewers) from user-writable and non-standard execution paths (e.g., Downloads, Temp). This behavior is characteristic of the CHOSEN BRICK malware's lure-execution stage, where users are socially engineered into running a decoy installer.
Detects the presence of PureLogs Stealer, a .NET-based information stealer, by identifying specific family name strings embedded within PE files that conform to the .NET assembly structure. This rule targets the static analysis of malicious binaries often used in credential harvesting campaigns.
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects known samples of the Atomic Stealer (AMOS) malware on macOS, specifically those associated with the Macfinger/ClickFix campaign, by matching their SHA256 hashes.
Detects unpacked Sauron Loader DLL samples by identifying a specific embedded configuration header (magic 0xbaadf00d) followed by RSA key material length fields. This indicates the presence of malicious configuration structures associated with the Sauron Loader malware.
Detects the presence of Sauron Loader by matching known SHA-256 hashes of the MSI installer and associated side-loaded DLLs, or by identifying malicious PE files containing the 'Sauron' string.
Detects specific file hashes associated with Atomic macOS Stealer (AMOS) Mach-O payloads, which are often delivered via staging scripts on macOS systems.
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
Detects the download and presence of the Atomic macOS Stealer (AMOS) payload, a 64-bit Mach-O executable, identified by specific file hashes or internal file structure characteristics (Mach-O magic bytes) within a specific file size range.
Page 26 of 80