Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Execution of ssh.exe to perform data exfiltration and tunneling through RDP
This rule detects the Linodas backdoor on Linux systems by identifying specific byte patterns related to its persistence mechanisms for Ubuntu and RedHat distributions, network communication functions, and machine ID generation routines. The rule looks for a combination of these patterns to ensure high fidelity detection of the malware.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
This YARA rule detects the SideTwist backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include anti-sandbox detection, collection of host information, communication with a command and control (C2) server, parsing C2 responses, downloading files from the C2, and replying to the C2 server. The rule requires all these distinct patterns to be present within a PE file (identified by the 'MZ' header) to trigger a detection, aiming to minimize false positives.
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
Replace.exe Usage
Sigma
Detects the use of Replace.exe which can be used to replace file with another file
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This rule detects the Minodo backdoor by identifying a combination of specific byte patterns (YARA signatures) within executable files. These patterns correspond to functions responsible for generating system IDs, encrypting and sending data, gathering system information, copying payloads into memory, and executing payloads from temporary locations. The presence of all these patterns indicates the likely presence of the Minodo backdoor.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
MsiExec Web Install
Sigma
Detects suspicious msiexec process starts with web addresses as parameter
This rule detects the Encoded01 ransomware based on specific byte patterns found within the malware's executable. The patterns correspond to functions involved in file enumeration, file encryption, and remote connection activities, which are characteristic behaviors of ransomware.
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
This rule detects the presence of TargetCompany ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include encrypting files, generating encryption keys, finding files to encrypt, and establishing remote connections, which are all characteristic behaviors of ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
Page 295 of 297