Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects execution or file activity involving SHA-256 hashes attributed to analyzed VVS Discord Stealer samples. This rule provides high-confidence indicator coverage and should be retained as supporting intelligence alongside the behavioral detections in this pack.
Detects DCSync replication attack for credential dumping from AD
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
This rule detects when the 'squid.exe' process is executed with command-line arguments indicating a configuration reload, restart, or explicit use of 'squid.conf'. This could be indicative of an attacker manipulating Squid proxy settings, potentially as part of the Squidbleed vulnerability exploitation or other malicious activity.
Detects attempts to exploit the Squidbleed vulnerability by monitoring process command lines for Squid (squid.exe) using specific accept_filter or defer_accept related keywords. This could indicate an attempt to bypass configuration or exploit a vulnerability related to TCP connection handling.
This rule detects suspicious command-line arguments indicative of a potential buffer overflow attempt targeting the 'squid.exe' process. The presence of keywords like 'buffer+', 'ptr++', 'offset', 'increment', or 'boundary' in the command line of 'squid.exe' suggests an attempt to manipulate memory or exploit a vulnerability.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
This rule detects processes that repeatedly attempt to allocate memory, which can be indicative of malicious activity such as injection, evasion, or resource exhaustion attacks. It specifically looks for Event ID 4688 (process creation) where the command line contains keywords related to memory allocation (allocate, reserve, memory, malloc) and excludes common legitimate processes like SQL Server, Java, and Python. A count of 3 or more such events within an hour for the same computer, filename, and user triggers the alert.
Detects unauthorized processes reading the .bash_history file concurrently with AWS CLI activity, which could indicate an adversary attempting to extract credentials or sensitive information from command history while interacting with AWS services. This behavior is associated with the Megalodon CI/CD malware.
Detects malicious .config modifications suppressing ETW telemetry and bypassing strong name verification, indicative of the Screening Serpens activity. The rule specifically looks for file modifications to .config files that include specific strings related to disabling ETW and bypassing strong name verification, combined with process command line arguments containing these same strings.
Correlates the reading of the '1.dat' container file, which is required for secondary stage decryption, with the execution of 'RuntimeBroker_update.exe'. This activity is indicative of the 'Dragon Weave' campaign.
Detects any process executing files with .vmxx extensions residing within the anomalous firefx- directories, which is indicative of activity related to Operation XENOFISCAL, specifically the deployment of persistent XenorRAT by the SideCopy threat group.
This rule broadly searches for the unique dead drop string 'OhNoWhatsGoingOnWithGitHub' across all command line executions, independent of node/bun, indicating potential compromise related to the Mini Shai-Hulud supply chain attack.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Detects attempts to exploit the Squidbleed vulnerability (C11 strchr() Null Terminator Behavior Exploitation) by monitoring 'squid.exe' process command lines for the presence of null terminator characters or their string representations. This indicates an attempt to manipulate string handling functions.
Detects potential exploitation attempts related to the Squidbleed vulnerability by monitoring 'squid.exe' or processes with 'squid' in their command line for AddressSanitizer related keywords indicating memory safety issues like overflow, underflow, or use-after-free.
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
Correlates Windows 365 or Citrix client execution with network share discovery commands by the same account on the same device within thirty minutes. This rule detects potential post-compromise activity where an attacker might be using a VDI session to enumerate network shares.
Vapt Framework Markers
YARA-L
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs.
Identifies the presence of the known ITScape (CVE-2026-46316) proof-of-concept executable by its SHA256 hash. This vulnerability enables a critical guest-to-host escape affecting ARM64 infrastructure.
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
Page 63 of 84