Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash. The rule looks for the presence of this hash in DeviceFileEvents (file creation on disk) or DeviceImageLoadEvents (module loaded into a process). This indicates an attempt to steal credentials from web browsers or web session cookies.
This rule detects the presence of the string "xhxhxhxhxhxpp" within the AdditionalFields of DeviceEvents. This string =represents a Mutex Indicator of Compromise (IOC).
This rule detects various stages of the VOID#GEIST multi-stage Python loader as described in the Securonix blog. It identifies initial batch file execution, Chrome decoy PDF lures, hidden PowerShell relaunching of the batch file, persistence via the Startup folder, curl commands downloading zip payloads, Python embedded runtime downloads, and final Python payload execution. The rule is designed to catch the distinct command-line patterns associated with each stage of this specific malware.
This rule detects the creation or modification of scheduled tasks using specific names identified in the Bitdefender APT36 Vibeware report. The rule looks for `schtasks.exe` executions where the command line contains one of the following task names: "MicrosoftEdgesUpdatesTasksMachineUAs-Task", "MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy", "DateAndTimeService", "personalServiceTask", or "LuminousBackupService". This helps identify campaign-specific persistence mechanisms used by APT36 Vibeware.
This query provides a 360-degree view of a phishing campaign's impact. Starting from a reported email's indicators (sender, subject), it finds all similar emails and correlates them with user actions like URL clicks, attachment interactions on endpoints, replies, and if the emails were zapped by Microsoft. This allows an analyst to quickly scope an incident and determine the extent of compromise.
Detects attempts to aggressively hijack file associations by modifying the Windows Registry using 'reg.exe' or 'cmd.exe'. Specifically looks for command-line arguments indicating deletion of 'UserChoice' registry keys (which define default applications for file types) and addition of 'ApplicationAssociationToasts' keys (which can suppress notifications related to file association changes). This behavior is indicative of an attacker trying to silently change default applications to maintain persistence or execute malicious code.
Detects the creation of files with the '.waiting' or '.wait' extension, which are appended by Crytox ransomware to encrypted files. This rule specifically looks for file creation events where the filename ends with these characteristic extensions, indicating potential ransomware activity.
This rule detects network connections to known pastebin and text storage sites initiated by processes that are not common web browsers. This could indicate data exfiltration, staging of malicious code, or command and control activity where sensitive information is uploaded or retrieved by non-standard applications.
This rule detects the presence of a specific browser credential extraction module associated with the StealC information stealer, as used in the FakeGit campaign. The detection is based on the module's SHA256 hash.
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
This rule detects brute force activity based on 'BruteForceActivityDetected' events from DeviceEvents. It identifies the attacking IP, the device being attacked, the credential being targeted, the workstation name, domain name, and the type of attack. It then summarizes the count of attacks per unique combination of these fields, ordered by the attack count.
This rule detects the presence of specific file hashes associated with the TrustConnect campaign on devices. It directly identifies known malicious lure files by their SHA256 hash, providing a narrow and high-confidence detection for triage and initial checks.
Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.
This rule detects the execution of 'CheckNetIsolation.exe' with the command-line arguments 'LoopbackExempt' and 'aad'. This specific command is used to exempt Universal Windows Platform (UWP) or Store apps from network loopback restrictions, often in the context of Azure Active Directory (AAD) authentication. While this can be a legitimate operation for development or specific application configurations, it can also be abused by malicious applications to bypass network isolation.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Correlates PowerShell extraction of specific files (steam_monitor, crashhandler, crashlog) with subsequent DLL side-loading where 'crashhandler.dll' is loaded by 'steam_monitor.exe' from a non-standard program or Steam directory, indicating a potential malware infection chain.
This rule detects attempts to hijack file associations by monitoring command-line executions of 'cmd.exe' or 'reg.exe' that involve deleting 'UserChoice' registry keys or adding 'ApplicationAssociationToasts'. This behavior is indicative of an adversary attempting to modify default program associations to achieve persistence or execute malicious code.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
Detects the loading of specific drivers known to be vulnerable and abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-level privileges and disable security tools.
Page 445 of 509