Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,122
15,644
12,592
8,402
6,229
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
KQL Query
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: Tracking Proton66 Activity with KQL
KQL Query
KQL Query
KQL Query from file: Hunting AI Recall on Windows 11 24H2
KQL Query from file: Hunting VEILDrive C2
KQL Query
KQL Query
This YARA rule detects the ChaosRAT backdoor by identifying specific byte sequences related to its network communication, system information gathering, and file download capabilities. The rule includes three distinct versions of these functionalities, indicating evolution or different variants of the malware. Detection relies on the presence of these unique byte patterns within executable files, specifically ELF files as indicated by the magic byte check.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects network connections to known command and control (C2) domains associated with the 'Banana Squad' threat actor using specific domain patterns and URL paths.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects network connections to domains used by GrayAlpha (FIN7) for distributing malicious payloads via fake browser/software update pages, specifically targeting the 'cdnXX.click' pattern and '/download.php' endpoint. This activity is associated with the initial access phase, leading to the deployment of loaders like PowerNet or MaskBat.
Detects network connections to known malicious domains and IPs associated with the Discord Invite Loop Hole campaign, including payload hosting, C2, and data exfiltration via Discord webhooks.
Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel
Page 182 of 190