Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This query helps reviewing malware detections by detection methods
This rule detects when a user, identified as having a high-risk relationship with GCP resources (specifically those containing sensitive data like US Social Security Numbers via GCP DLP context), downloads an executable file. The detection correlates network proxy events showing executable downloads or large file transfers with EDR events indicating Microsoft Excel activity on the same host and by the same user within a 5-minute window. This scenario is indicative of a potential malicious macro in an Excel document downloading and executing malware.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.). This often indicates an attempt to execute malicious code via Office applications, leveraging common living-off-the-land binaries (LOLBINs) or other suspicious executables.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Identify process creations that are tagged exploit in VT
Alert on downloading a known file hash from a known IP with VT Relationships.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Executable downloaded by Microsoft Excel by user with GCP entity relationship
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
Detects the Kapeka Backdoor binary being loaded by rundll32.exe. The Kapeka loader drops a backdoor, which is a DLL with the '.wll' extension masquerading as a Microsoft Word Add-In. The rule specifically looks for rundll32.exe loading a DLL with a '.wll' extension from common user-writable directories like ProgramData or AppData\Local.
Detects execution of executables disguised as media/archive files with deceptive filenames from download or app data directories, linked to the Fake Kling AI campaign.
Detect process launch events that correlate to Safe Browsing hash data and have low prevalence
IOC Hash Prevalence
YARA-L
Detect process/file events that match hashes found in our MISP instance and have low rolling max prevalence
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
Identify process and file creation using safe browsing hashes where the first and last seen are more than 7 days apart
Alert on known File Hash executing known File Hash with VT Relationships.
Detect web traffic to a recently expired domain followed by an exe file creation event
Page 83 of 86