Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the presence of the keywords "Wscript", "Shell" and "Run" in the command, which could indicate a suspicious activity
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Detects usage of wsudo (Windows Sudo Utility). Which is a tool that let the user execute programs with different permissions (System, Trusted Installer, Administrator...etc)
Detects python spawning a pretty tty
Detects suspicious sysprep process start with AppData folder as target (as used by Trojan Syndicasec in Thrip report by Symantec)
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script to run for a specific VM state
Detects execution of the "VMwareToolBoxCmd.exe" with the "script" and "set" flag to setup a specific script that's located in a potentially suspicious location to run for a specific VM state
Detects suspicious child process creations of VMware Tools process which may indicate persistence setup
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Minodo backdoor by identifying a combination of specific byte patterns (YARA signatures) within executable files. These patterns correspond to functions responsible for generating system IDs, encrypting and sending data, gathering system information, copying payloads into memory, and executing payloads from temporary locations. The presence of all these patterns indicates the likely presence of the Minodo backdoor.
Detects Windows shells and scripting applications that write files to suspicious folders
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
Yara rule that detects Awfull virus.
Yara rule that detects DeadCode virus.
Page 154 of 154