Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects instances where an executable masquerading as 'msedge.exe' (Microsoft Edge) is launched from a user's Startup folder. The rule looks for files identified as 'msedge.exe' that contain metadata or product information associated with DISM (Deployment Image Servicing and Management) or base Windows operating system components, indicating a potential attempt to disguise a different utility or payload as a trusted web browser.
Detects a single host or account interacting with a high volume of archive (PST/OST) and document files, or initiating mailbox exports within a short window, which is often indicative of mass data staging and collection prior to exfiltration.
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.
Detects the creation of files within the /etc/cron.d/ directory initiated by the redis-server process, specifically looking for malicious payloads containing bash -c and /dev/tcp/ command wrappers indicative of a reverse shell or beaconing persistence mechanism often used by Redis-targeting botnets.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects unauthorized processes (non-browser applications) creating, modifying, or renaming sensitive browser data files such as Login Data, Cookies, or local state files within standard browser profile directories. This activity is indicative of credential harvesting or session hijacking attempts by malicious software.
Detects the GHAPPIER four-stage malware loader, specifically targeting npm-based JavaScript files. The rule identifies malicious activity through specific artifacts including hardcoded C2 URLs (vercel.app domains), campaign markers, file paths, and eval-based execution patterns.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
Detects the obfuscated index.js payload bundled in the compromised actions-cool/issues-helper and actions-cool/maintain-one-comment commit a0c53dd42fc842d2f9276c5a1d4f9a26abe8713d, executed via 'bun run $GITHUB_ACTION_PATH/index.js'
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects GitHub Actions workflows that explicitly reference specific 'actions-cool' GitHub actions using a known-bad mutable version tag ('@v2.2.1'). This tag corresponds to malicious code introduced into these repositories, allowing for potential CI/CD pipeline poisoning and supply chain compromise.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Page 27 of 139