Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects the use of WebDAV by a client, specifically identifying the 'Microsoft-WebDAV-MiniRedir/' user agent during a GET request. This behavior is often associated with 'DownloadCradle' techniques used by adversaries to download malicious content or exfiltrate data.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Detects the execution of 'curl.exe' when a custom User-Agent string is specified using either the '-A' or '--user-agent' command-line options. This behavior can be indicative of an adversary attempting to mimic legitimate web traffic while using a non-standard User-Agent to evade detection or to identify themselves to a C2 server.
Detects suspicious file downloads directly from IP addresses using Wget.exe. This rule looks for executions of wget.exe where the command line contains an IP address, 'http', an output flag like '-O' or '--output-document', and a suspicious file extension. This behavior is often associated with adversaries transferring tools or malware onto a compromised system.
Malware User Agent
Sigma
Detects suspicious user agent strings used by malware in proxy logs
Detects Baby Shark C2 Framework default communication patterns
Detects a suspicious curl process start on linux with set useragent options
Detects WebDav DownloadCradle
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters
Detects wannacry killswitch domain dns queries
Detects suspicious malformed user agent strings in proxy logs
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Yara rule that detects NjRAT backdoor.
This rule detects the Linodas backdoor on Linux systems by identifying specific byte patterns related to its persistence mechanisms for Ubuntu and RedHat distributions, network communication functions, and machine ID generation routines. The rule looks for a combination of these patterns to ensure high fidelity detection of the malware.
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
Yara rule that detects TimeCrypt ransomware.
Page 189 of 190