Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects when a file, identified as malicious by Google Safe Browsing, initiates an outbound network connection to an IP address known to be a Tor Exit Node, as identified by Google Cloud Threat Intelligence (GCTI) Feed. This indicates potential command and control (C2) communication or data exfiltration by malware attempting to anonymize its network traffic.
Detects a highly relevant Antivirus alert that reports ransomware. This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place. The rule specifically looks for signatures containing common ransomware family names and keywords.
This rule detects network connections initiated by a file whose SHA256 hash is known, via VirusTotal relationships, to contact a specific IP address. It correlates network connection events with VirusTotal intelligence to identify potentially malicious communication.
This rule identifies process and file creation events where the associated file's SHA256 hash is present in Google Safe Browsing data and has been observed for a duration greater than 7 days (604,800 seconds). This long observation period for a Safe Browsing-flagged hash could indicate persistent malware or a file that has been present on systems for an extended time before being flagged or detected.
This rule detects the creation or launch of processes or files that match known Indicators of Compromise (IOCs) from a MISP instance and exhibit low prevalence (3 or fewer occurrences) over a 10-day rolling period. This combination suggests potentially malicious activity that is not widespread, indicating a targeted attack or early-stage malware.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
This rule detects the creation of new files or the launch of processes whose SHA256 hash matches an indicator of compromise (IOC) from a MISP feed. It correlates process launch or file creation events with known malicious SHA256 hashes ingested from MISP, indicating potential malware execution or presence on a system.
This rule detects the launch of processes whose executable files are identified as malicious by Google Safe Browsing and exhibit low prevalence within the environment. Specifically, it looks for process launch events where the SHA256 hash of the executable matches a hash flagged as 'CRITICAL' severity by Google Safe Browsing. Additionally, the rule filters for executables that have been observed on a maximum of 3 distinct machines over a 10-day rolling period, indicating low prevalence and a higher likelihood of being a targeted or novel threat.
Yara rule that detects Skuld infostealer.
Yara rule that detects VanHelsing ransomware.
Detects the loading of specific DLLs associated with Katz Stealer malware, particularly variants from 2025. The presence and loading of these DLLs strongly indicate malicious activity on the system, as Katz Stealer is known for stealing sensitive information.
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant known for stealing sensitive information. In enterprise environments, such DNS queries may indicate potential malicious activity or compromise.
Alert on known Hash querying a known hostname with VT Relationships
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where four or more specific Snort signature IDs occur within a 15-minute span from the same host. This behavior is highly indicative of a successful infection by Lumma Stealer.
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
A malicious file contacting a known Tor Exit Node.
Page 199 of 232