Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Detects the execution of 'curl.exe' with command-line arguments indicating the use of SOCKS proxies (socks5h, socks5, socks4a) and targeting '.onion' domains. This combination is highly indicative of activity associated with the Kalambur backdoor, which leverages TOR for command and control.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
Detects HTTP requests indicative of Oyster malware C2 beaconing, including GET requests to /reg with WordPressAgent User-Agent and application/json Content-Type, GET requests to /login with FingerPrint User-Agent, and GET/POST requests to /api/kcehc or POST requests to /api/jgfnsfnuefcnegfnehjbfncejfh.
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
This rule detects the use of the Deployment Image Servicing and Management (DISM) tool to enable the 'WindowsPowerShellWebAccess' feature. Adversaries may enable this feature to establish remote access to a system, potentially for persistence, privilege escalation, or further malicious activities. The detection specifically looks for `dism.exe` or `DISM.EXE` being executed with command-line arguments that include 'WindowsPowerShellWebAccess', '/online', and '/enable-feature'.
Hunts for multi-stage attacker behavior involving executables dropped to user directories, co-located DLL loads, and outbound network connections to Azure cloud domains used as command-and-control infrastructure. This query surfaces advanced adversary tradecraft where payload delivery, code execution, and cloud-based C2 are tightly correlated.
Detects network connections from web browsers to domains associated with the UNC5142 EtherHiding technique, including a specific blockchain node and malicious Cloudflare Pages domains.
The analytic detects the execution of `gpupdate.exe` without command line arguments and with an active network connection. This behavior is identified using Endpoint Detection and Response (EDR) telemetry, focusing on process execution and network traffic data. It is significant because `gpupdate.exe` typically runs with specific arguments, and its execution without them, especially with network activity, is often associated with malicious software like Cobalt Strike. If confirmed malicious, this activity could indicate an attacker leveraging `gpupdate.exe` for lateral movement, command and control, or other nefarious purposes, potentially leading to system compromise.
Detects a non-browser process launching a browser with automation flags, which subsequently connects to WhatsApp Web. This behavior is consistent with the Maverick banking trojan's use of Selenium and WPPConnect to hijack WhatsApp sessions for self-propagation.
This analytic detects suspicious downloads from common file sharing and content delivery platforms using known living-off-the-land binaries (LOLBins) such as 'curl.exe', 'certutil.exe', 'msiexec.exe', 'powershell.exe', 'wmic.exe', and others. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These tools are often abused by adversaries and malware to retrieve payloads from public hosting platforms such as GitHub, Discord CDN, Transfer.sh, or Pastebin. This detection helps identify potential initial access, payload staging, or command and control activity using legitimate services.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
Detects network connections to the Discord API from non-Discord processes, a behavior associated with the ChaosBot malware.
This rule detects successful network connections from devices to domains identified as high-confidence threats by ThreatView.io. It specifically looks for outbound connections to public IP addresses where the remote URL's domain matches an entry in the ThreatView high-confidence feed.
KQL Query
Detects authentication and Office activity where User-Agent strings match known malicious, reconnaissance, scanning, or C2 tool fingerprints. Helps identify automated attacks, credential stuffing, and adversary tooling.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Detects a series of Salesforce Object Query Language (SOQL) queries indicative of data reconnaissance and exfiltration, similar to techniques used by UNC6395.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Page 175 of 190