Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This analytic detects instances where the `rundll32.exe` process creates new executable (`.exe`) or dynamic link library (`.dll`) files. This behavior is identified by monitoring Sysmon EventCode 11 (FileCreate). `rundll32.exe` is a legitimate Windows utility, but it is frequently abused by adversaries to execute malicious code, establish persistence, or escalate privileges. Malware families like IcedID are known to leverage `rundll32.exe` to drop payloads in common user-writable directories such as `Temp`, `AppData`, or `ProgramData`. Detecting this activity can indicate the presence of malicious software attempting to deploy its components.
The analytic detects the `wermgr.exe` process creating an executable file. This behavior is unusual because `wermgr.exe` is typically associated with error reporting, not file creation. Such activity is significant as it may indicate TrickBot malware, which injects code into `wermgr.exe` to execute malicious actions like downloading additional payloads. If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
This YARA rule detects the BackConnect backdoor by identifying specific byte patterns related to its network communication, system information gathering, DNS server enumeration, and network interface enumeration functionalities. The rule looks for distinct code sequences that are characteristic of how this malware operates.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Yara rule that detects AutoColor backdoor.
Yara rule that detects BackConnect backdoor.
This rule detects the Linux GobRAT backdoor by identifying specific byte patterns associated with its functions for getting local IP addresses, MAC addresses, handling TCP network communication, and managing telnet tasks. The rule specifically targets ELF executable files.
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
This rule detects the Linux_Backdoor_WolfsBane malware based on specific byte patterns found in its code. The patterns correspond to functions for loading embedded libraries, decrypting embedded libraries, and removing the backdoor. The rule specifically targets ELF executables.
Yara rule that detects Sshdinjector backdoor.
Yara rule that detects GobRAT backdoor.
Yara rule that detects WolfsBane backdoor.
Yara rule that detects wmRAT backdoor.
This rule identifies when a user downloads, views, or copies a potentially malicious file from Google Drive. The detection is triggered if the file has a public visibility setting ('people_with_link' or 'public_on_the_web') and its name matches a common executable or script file extension (e.g., .dll, .exe, .scr, .jar, .pif, .app, .dmg, .pkg, .elf, .so, .bin, .deb, .rpm, .sh, .hta, .lnk). This aims to detect user interaction with suspicious files that could lead to execution of malicious code.
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
This YARA rule detects the Elpaco ransomware by identifying specific byte patterns within the executable. The patterns are associated with functions for finding files, writing console logs, getting system information, setting up an 'everything' library (likely for file enumeration), and deleting shadow copies. The rule requires all these sets of patterns to be present, indicating a high confidence detection of the Elpaco ransomware.
Yara rule that detects Elpaco ransomware.
Yara rule that detects MiyaRAT backdoor.
This rule detects when a user bypasses Chrome Safe Browsing warnings for potentially dangerous content or downloads. It specifically looks for events where Chrome Management reports a bad navigation event, dangerous download event, content transfer event, or unscanned file event, and the security result indicates the event was 'BYPASSED' by the user. The rule also assigns a risk score based on the category of the bypassed threat, with higher scores for malware, dangerous hosts, and social engineering.
Page 202 of 232