Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects the presence and activity of known malicious browser extensions, specifically 'NexShield' and those associated with the 'KongTuke' campaign. It identifies these extensions by their unique IDs found in file paths or names, network connections to associated malicious IPs or domains, and specific file hashes. The rule correlates file events, network events, and process events to provide a comprehensive view of the malicious extension's activity, including when it was first and last seen, the browsers involved, and the files/folders it interacted with.
A widespread campaign employs malvertising to distribute converter tools that secretly install persistent Remote Access Trojans. These droppers establish scheduled tasks and leverage code signing to load and execute further malicious .NET assemblies from command-and-control servers, enabling continuous system access and data exfiltration.
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.
This rule detects potential network beaconing activity by analyzing network connection events. It identifies repetitive outbound connections from a device to a remote IP and port with a consistent time interval (low jitter). The rule filters out known legitimate processes and domains to reduce false positives. It calculates the average time delta between connections, standard deviation, and interquartile range to identify beacon-like patterns. The rule also considers the number of unique devices connecting to the same remote endpoint to identify potentially compromised infrastructure.
Detects network connections or DNS queries to command and control (C2) domains associated with the TamperedChef malvertising campaign.
Detects network connections to domains associated with the DarkSpectre threat actor's campaigns, including GhostPoster, ShadyPanda, and The Zoom Stealer. These campaigns leverage malicious browser extensions for data theft, affiliate fraud, and corporate espionage.
Detects network traffic to web services associated with the ggwave project, such as 'ggwave.ggerganov.com'. These services can generate audio payloads from text, which could be used for covert data exfiltration over an acoustic channel, bypassing traditional network monitoring for the data content itself.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
This rule detects outbound network connections initiated by 'chrome.exe' to a predefined list of known Command and Control (C2) domains over HTTPS (port 443). This indicates potential communication with malicious infrastructure.
Detects Cobalt Strike Beacon payloads, specifically those associated with the APT24 BADAUDIO campaign, by looking for a unique watermark hash in command-line arguments or specific beacon executable/DLL names during process creation. The rule targets the Cobalt Strike Beacon watermark hash "BeudtKgqnlm0Ruvf+VYxuw==" and a generic "Watermark_Hash" string, alongside process images ending with '\beacon.exe' or '\beacon.dll'.
This rule detects network connections and DNS queries to command-and-control (C2) domains associated with malicious Chrome extensions. These extensions are known to steal sensitive data such as ChatGPT and DeepSeek conversations, as well as other browsing data. The rule specifically targets known malicious domains to identify C2 communication and potential data exfiltration.
Detects execution of BADAUDIO malware downloader used by APT24
Detects the execution of a DLL that contains specific cryptographic function calls (SystemFunction036 or RtlGenRandom) and is launched by common DLL loading mechanisms (rundll32.exe, regsvr32.exe, or mshta.exe). This pattern is indicative of the BADAUDIO malware, a first-stage downloader used by APT24, which is known for using SystemFunction036 for cryptographic operations and being delivered as a DLL.
Detects creation of SesameOp marker and exception files used by the OpenAIAgent.Netapi64 implant. Observable files include marker 'Netapi64.start' and exception logs 'Netapi64.Exception' created under 'C:\Windows\Temp\'; creation of either file is a high-fidelity indicator of SesameOp loader activity.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Detects file creation events for specific files downloaded by the Turla Kazuar v3 loader. The malware downloads a set of files into the %LOCALAPPDATA%\Programs\HP\Printer\Driver directory including hpbprndi.exe (a legitimate signed Hewlett-Packard printer driver installer used as a loader with SHA256: 34b7df7919dbbe031b5d802accb566ce6e91df4155b1858c3c81e4c003f1168c), hpbprndiLOC.dll (the actual Kazuar v3 loader DLL that implements COM-based.
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
Detects network connections to Kazuar v3 command and control servers. The malware communicates with C2 infrastructure using HTTP/HTTPS protocols (ports 80/443) to any internet-routable IPv4 address. The loader uses WinHttp.WinHttpRequest.5.1 COM object for HTTP requests and ignores SSL certificate validation errors (SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056). File downloads are performed using ADODB.Stream, and User-Agent strings typically contain "WinHttp" or "ADODB" indicators. This rule matches any valid IPv4 address to account for the fact that Turla may use different C2 IPs across campaigns. The rule focuses on HTTP/HTTPS traffic which is the primary communication method used by the loader to download components and exfiltrate data.
Page 170 of 190