Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Suspicious Git Clone
Sigma
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
Yara rule that detects ChinaZ trojan.
This YARA rule detects the SideTwist backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include anti-sandbox detection, collection of host information, communication with a command and control (C2) server, parsing C2 responses, downloading files from the C2, and replying to the C2 server. The rule requires all these distinct patterns to be present within a PE file (identified by the 'MZ' header) to trigger a detection, aiming to minimize false positives.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
Yara rule that detects ProjectHookPOS infostealer.
Page 63 of 63