Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the creation of a hard link using mklink.exe, where the source is in C:\ProgramData and the destination is an executable in a user's AppData or Temp directory. This technique was observed in an APT36 campaign to stage and execute payloads while evading path-based detections.
Detects the creation of files within hidden folders on removable media that are designed to mimic the Windows Recycle Bin ($RECYCLE.BIN or $RECYCLE.BIN.USER). This technique is used by APT37's THUMBSBD and VIRUSTASK malware to stage malicious files (.rb, .dat) for bridging air-gapped networks.
Detects the presence of malicious Chrome extensions associated with the 10xprofit affiliate hijacking campaign. These extensions are installed as folders with the extension ID as the name in the user's browser profile directory. The rule identifies file events in common browser extension paths for Chrome and Edge, extracts the extension ID, and checks if it matches a known list of malicious IDs.
Detects the deletion of the RunMRU registry key and the clearing of the clipboard within a short time window on the same host. This sequence of anti-forensic actions is used by the batch script component of the Dohdoor malware campaign to hide its tracks.
Detects the execution of AutoIt3.exe (or renamed versions) from non-standard paths or with suspicious script extensions, which is indicative of CastleLoader activity. This rule specifically looks for AutoIt interpreter execution, including renamed files with .pif or .com extensions, originating from common temporary or user-writable directories like AppData or Temp, and executing suspicious script file extensions such as .a3x, .t, or .vstm, or very short command lines.
Detects a Node.js process making outbound network connections to known malicious infrastructure associated with a developer-targeting campaign. The campaign used Vercel for staging and specific IPs for C2.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects a sequence where a service terminates unexpectedly, followed immediately by a process creation from the Service Control Manager (services.exe). This pattern can indicate that a service's recovery options have been configured to run a malicious program upon failure.
This rule detects phishing attempts related to a Booking.com campaign. It identifies suspicious URLs containing 'op_token' or 'tpo_token' parameters, often combined with paths like 'complaint' or 'reserv', on non-Booking.com domains. It specifically looks for punycode domains (e.g., 'xn--*'), lookalike domains (e.g., '*booklng*', '*mgmnt*', '*portal*'), and specific high-signal punycode domains identified in reports. The rule also includes a pattern for partner kit redirect URLs with 'tpo_token' on 'booklng' subdomains. Additionally, it suggests looking for specific email patterns from Gmail senders with subjects like 'Automatic reply', 'Availability', or 'Reservation' that contain embedded URLs matching 'complaint?op_token='.
Detects two persistence techniques used by EncystPHP: the creation of backdoored root-level accounts and the injection of SSH keys into user accounts. Specifically, it looks for 'useradd' commands creating accounts with UID 0 and specific generic usernames, and modifications to '.ssh/authorized_keys' files by non-root/non-sshd processes.
Detects a high volume of file renaming operations to the '.ENCRT' extension, combined with the creation of the 'R3ADM3.txt' ransom note by the same process. This behavior is characteristic of the Gunra ransomware encryption routine.
This rule identifies various activities associated with the Dohdoor malware campaign, combining multiple detection heuristics into a single result set. It looks for PowerShell executing curl to download batch scripts, copied Windows tools run from shared folders with unusual arguments, suspicious DLL loads from shared folders, and network connections to C2-style domains identified in the campaign.
Detects a process performing rapid, high-volume file system enumeration across multiple drives while deliberately avoiding critical system directories, a behavior consistent with the reconnaissance phase of Gunra ransomware.
Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.
Detects a process requesting read access (GrantedAccess 0x1010) to the LSASS process memory (lsass.exe). This technique is commonly used by threat actors to dump credentials for lateral movement and ransomware deployment. The rule specifically looks for the GrantedAccess value '0x1010', which corresponds to PROCESS_VM_READ and PROCESS_QUERY_INFORMATION access rights, and excludes a list of known legitimate processes.
Detects persistence mechanisms used by the HoneyMyte APT group's CoolClient backdoor. The rule looks for the creation of a specific scheduled task ('ComboxResetTask') or the modification of a registry run key to include the 'work' parameter, which are characteristic of the backdoor's 'passuac' and 'install' routines.
Detects node.exe executing from non-standard, user-writable locations, a TTP associated with the Tsundere Bot malware used by TA584. This rule specifically looks for Node.js runtime execution initiated by common shell or script host processes from directories like AppData or Users\Public.
Detects the creation of files with a 64-character hexadecimal filename followed by a '.keystore' extension. This is a unique artifact of the Gunra ransomware's 'separate keystore' mode used for storing encryption keys.
Detects outbound network traffic to a known Atomic macOS Stealer (AMOS) command and control (C2) server. This activity is associated with the exfiltration of stolen data, such as credentials, browser data, and system information, compressed into a ZIP archive.
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
This rule detects activities associated with the XWorm LATAM campaign. It identifies network indicators such as specific C2 domains (jholycf100.ddns.com.br, voulerlivros.com.br, res.cloudinary.com), a specific IP address (152.249.17.145), and a destination port (7000). It also looks for the abuse of CasPol.exe making outbound connections to the identified C2 infrastructure. Furthermore, the rule detects PowerShell processes spawned by WMI (WmiPrvSE.exe) that attempt to fetch content from Cloudinary and load assemblies in memory, indicating potential in-memory execution. Finally, it includes a specific SHA256 file hash (7befeacf0b3480fb675d0cab7767b5b9697edc9d0e05982025a06ead0054afd5) associated with the campaign.
Page 448 of 509