Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,456
11,839
5,876
5,155
4,865
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the download and presence of the Atomic macOS Stealer (AMOS) payload, a 64-bit Mach-O executable, identified by specific file hashes or internal file structure characteristics (Mach-O magic bytes) within a specific file size range.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Comprehensive IOC sweep across endpoint file/process/network telemetry for the full set of known SilkParasite/SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy infrastructure indicators reported by Hunt.io and Security Affairs: all listed C2/decoy/certificate-hosting IPs, all listed spoofed/infrastructure domains, and known file/certificate hashes (SHA256, SHA1).
This rule detects the execution of 'DriverInstaller.exe' (either by filename or a known malicious SHA256 hash) that subsequently initiates network connections to GitHub domains. This behavior is indicative of potential malicious activity, such as downloading secondary payloads, command-and-control communication, or beaconing from a suspected rogue or masquerading driver installation utility.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
Detects the execution of the 'sckit' Go implant, a malicious binary associated with trojanized '@memtensor/memos-cloud-openclaw-plugin' or 'MemoryOS' packages. The rule identifies instances where this binary is spawned as a child process of a language runtime (Node.js or Python) when the execution originates from specific directory paths associated with these packages, or when the parent process command line indicates these packages are being initialized.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects suspicious PE files that masquerade as Mozilla Firefox by using Firefox-related product names and metadata, but lack valid Mozilla Corporation code-signing signatures and are located within the ProgramData directory.
Detects files that contain a valid RTF file header but also contain signatures indicative of embedded non-RTF content such as PE executables, ZIP archives, or OLE objects. This technique is often used to masquerade malicious payloads as benign document files.
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects architecture-specific Mach-O 64-bit AMOS Stealer binaries dropped by the Macfinger ClickFix first-stage shell script, requiring multiple distinctive C2 endpoint strings alongside Mach-O magic and size constraints to reduce false positives
Detects specific samples of the Rmrlx information stealer by identifying unique file artifacts, mutex names (e.g., Global\EVOLUTION), and debugging/staged files commonly associated with its execution environment, including samples exhibiting IP-checking evasion techniques.
This rule detects potential malicious activity by monitoring for known malicious file hashes (MD5) across file and process events, and correlating them with known Command and Control (C2) infrastructure communication patterns, including specific IP addresses and URI paths.
This rule detects known JavaScript payloads associated with the JWR phishing framework by matching their SHA-256 file hashes. This is a signature-based detection for malicious script files commonly used in phishing attacks.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
Page 27 of 80