Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
6
2
1
Contributors
9
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
5
2
2
1
1
Products / Services
4
2
1
1
1
MITRE Techniques
3
3
2
2
1
Detects the NetworkShareScanner SMB/USB worm by known hash or by unsigned-executable propagation to remote shares/removable drives.
Detects the StopAndProtect VBS spreader (RegisterRC6inPlace.vbs / Payloadvbs.b64) propagating via removable media and/or WMI remote process creation.
Detects ELF binaries embedding the ClientKing implant name alongside structural indicators (Rust runtime markers or C2 configuration patterns), associated with Jewelbug espionage tooling targeting Linux servers and routers
Detects accounts authenticating from compromised webmail/CMS infrastructure that pivot, within a tight time window and matching source IP, to authenticate against internal virtualization-management systems — the lateral-movement pattern Jewelbug used to reach a national webmail estate's backing infrastructure.
Detects the Abyssos HVNC_CLONE_START to GRABCOOKIES to cookie-injection chain: browser profile/cookie staging under a temp fontconfigs folder correlated with a non-browser process connecting to a local Chrome/Edge/Brave remote-debugging port (9222) used for Network.setCookie session hijacking.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.
Detects the XCSSET zip_infect_finder worming module recursively traversing directories to infect Xcode projects packaged inside .zip archives.