Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
This rule detects potential smishing or malvertising attacks by monitoring network activity for the download of .apk files from non-reputable domains. It correlates these download attempts with previous browsing behavior on URLs containing specific 'fake app-store' lure patterns (e.g., promotional text like 'Nexus One' or 'Download Now' outside of official marketplaces like Google Play, APKMirror, or APKPure).
Detects the execution of known malicious MSI files associated with the LegionLoader malware family by monitoring process creation events involving msiexec.exe. The rule matches on specific file hashes and filenames identified in technical analysis of LegionLoader variants.
This rule detects the creation of executable files (.exe or .dll) within the 'C:\Windows\SysWOW64\' directory by processes other than trusted Windows OS installation or servicing components. This activity is indicative of potential malware staging, side-loading, or persistence mechanisms where an adversary drops malicious payloads into a trusted system directory to evade detection.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects the execution of Regsvcs.exe or Regasm.exe, which are trusted Windows .NET binaries, from non-standard or user-writable directories (such as Temp, AppData, Downloads, or User profiles). Adversaries often abuse these binaries to proxy the execution of arbitrary malicious code (DLLs) by bypassing application control policies.
This rule detects the presence and execution of known suspicious files (hashes provided) or specific malicious artifacts, such as 'hmn_hook.dll' being loaded, or the execution of binaries named 'auto.exe' and '78324.exe' associated with specific command-line arguments. It monitors file events, image loads, and process creation to identify potential malware activity.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
KQL Query from file: JivaChat Installer - Full Chain
KQL Query from file: JivaChat Installer - Full Chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects behavior indicative of the MLTBackdoor malware, specifically the creation or modification of a DLL file (such as *dlp.dll) shortly after or before the creation of an RC4-encrypted 'data.bin' file on the same host. The rule also looks for an optional preceding archive extraction event of common file types from Temp or Downloads directories by standard extraction utilities, which may indicate the staging of the initial payload.
Detects a fake ClaudeDesktop.exe installer / tampered libcef.dll sideload chain deploying the SectopRAT .NET RAT, requiring multiple corroborating indicators and a PE anomaly consistent with DLL sideloading rather than a single generic string
Page 20 of 80