Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
78 detections
Filters
Last updated
All Time
Detection languages
30
24
11
8
3
Contributors
19
15
14
5
4
Categories
33
22
22
22
21
Platforms
57
10
9
7
4
Products / Services
13
11
9
6
6
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
IDS Classtypes
3
IDS Protocols
3
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Infostealer distributed via fake open-source tool impersonation sites
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
Detects the execution of OXLOADER (aBsvwbdas.exe) which drops a maliciously crafted .ocx file (a copy of dui70.dll) into the %TEMP% directory. This behavior is indicative of module stomping to facilitate the in-memory execution of CASTLESTEALER via techniques like DonutLoader and RunPE.
Detects the creation of scheduled tasks using 'schtasks.exe' with command line arguments that indicate suspicious activity. This includes tasks created in common temporary or user-writable directories, or tasks that involve PowerShell with encoded commands or obfuscated strings, which are often used by adversaries for persistence or execution.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
This rule detects HTTP responses containing a payload that appears to be XOR encrypted. It specifically looks for a sequence of at least 200 bytes consisting of non-printable ASCII characters (0x01-0x1f and 0x7f-0xff) within the file data of an HTTP response flowing to the client. This pattern is indicative of XOR encryption, often used by malware to obfuscate its payload.
Detects base64 encoded payloads in HTTP request bodies indicating obfuscation
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects XOR-encrypted payload delivery used to evade signature detection
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Page 3 of 4