Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the Voldemort backdoor by identifying specific byte patterns related to its configuration decryption, general decryption algorithm, access token request mechanism, network communication routines, and data download functions from its command and control (C2) server. The rule looks for a combination of these distinct code segments within a Windows executable (MZ header).
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
Yara rule that detects Voldemort backdoor.
Yara rule that detects Cicada3301 ransomware.
This YARA rule detects the GTPDOOR backdoor by identifying specific byte patterns within its code. The rule includes two main detection blocks, one for 'v1' and another for 'v2' versions of the backdoor, each looking for distinct functions related to sending results to a peer, executing remote commands, sending replies, and checking if the daemon is already running. The 'v1' block specifically targets functions like 'send_result_to_peer_v1_p*', 'execute_remote_command_v1', 'send_reply_v1_p*', and 'daemon_already_running_check_v1'. The 'v2' block targets 'send_result_to_peer_v2_p*', 'execute_remote_command_v2', and 'main_routine_v2_p*'. The rule also ensures the file is an ELF executable by checking the magic bytes at the beginning of the file.
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
Yara rule that detects OrcusRAT backdoor.
Yara rule that detects GTPDOOR backdoor.
This YARA rule detects the NoodRAT backdoor by identifying specific byte sequences (patterns) associated with its core functionalities. These functionalities include changing the system name, decrypting configuration data, encrypting and sending data, and receiving and decrypting data. The rule specifically targets Linux ELF executables, indicated by the magic byte `0x464C457F` at offset 0.
This YARA rule detects the Daolpu infostealer by identifying specific byte patterns related to its core functionalities. These functionalities include network communication, searching for sensitive files on the system, parsing Firefox configuration files, and collecting browser passwords and cookies. The rule requires all these distinct patterns to be present within a file to trigger a detection, aiming to reduce false positives.
Yara rule that detects NoodRAT backdoor.
Yara rule that detects Daolpu infostealer.
Detects suspicious user agent strings commonly used by various malware families and Remote Access Trojans (RATs) in proxy logs. This rule identifies specific user-agent patterns associated with known threats like DragonOK, PlugX, HTTPBrowser RAT, njRAT, ZeroAccess, Dyre, Upatre, Ghost419, W32/Renos.Downloader, Kazy, Sality, Fareit, Toby web shell, Loki Bot, Pony, MacControl malware, Zebrocy, Ursnif, Emotet, Lockbit, Quasar RAT, Havana, AntSword, Racoon Stealer, AresLoader, Lilith Stealer, SVC Loader, WSHRAT, Zerobot, Nymaim, DarkCloud, BunnyStealer, SparkRAT, B4B3RAT, and Latrodectus loader.
Detects specific command-line patterns and process image paths associated with the REvil ransomware group's attack on Kaseya VSA. The rule looks for execution of 'cert.exe' and 'MsMpEng.exe' from unusual paths, as well as specific file deletion commands and references to 'Kaseya VSA Agent Hot-fix' and 'agent.exe'/'agent.crt' in 'kworking' or 'kworking1' directories, which were observed during the Kaseya supply chain incident.
This rule detects relevant ClamAV messages indicating the presence of various types of malware. It specifically looks for keywords like 'Trojan*FOUND', 'VirTool*FOUND', 'Webshell*FOUND', 'Rootkit*FOUND', and 'Htran*FOUND' in ClamAV logs. These keywords suggest that ClamAV has identified and reported a malicious file or component.
Detects potential Command and Control (C2) communication associated with the Small Sieve malware. This rule specifically looks for HTTP GET requests to 'api.telegram.org' with a specific chat_id and 'text=com/' in the URI, which are indicators of Small Sieve's use of the Telegram Bot API for C2.
This rule detects specific command-line parameters and image paths associated with Mustang Panda droppers. It looks for patterns like 'Temp\wtask.exe /create', specific environment variable manipulations ('%windir:~-3,1%%PUBLIC:~-9,1%', '%windir:~-1,1%'), VBScript execution with file paths containing 'C:\Users\' and '.txt', and the execution of 'Temp\winwsh.exe'. These indicators are characteristic of the dropper stage used by the Mustang Panda APT group.
Detects when Code Integrity identifies and blocks the loading of an image (DLL, EXE, etc.) that has a revoked digital certificate. This indicates an attempt to load untrusted or malicious code, potentially bypassing security controls. Event ID 3035 specifically notes cases where the image is allowed to load due to a kernel mode debugger being attached, which is a highly suspicious activity.
Detects when Microsoft Cloud App Security reports that a user has uploaded files to the cloud that are potentially infected with ransomware. This indicates a possible ransomware attack attempting to encrypt or exfiltrate data via cloud storage.
This rule detects the execution of 'osacompile' and 'curl' in the same command line. This combination is indicative of in-memory downloading and compiling of applets, a technique observed in the XCSSET malware. 'curl' is used to download content, and 'osacompile' is used to compile AppleScript or JavaScript for Automation (JXA) scripts, which can then be executed.
Page 204 of 232