Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule detects the presence of files or process execution events matching a known set of SHA256 hashes associated with the BlueMoon malware family. The detection covers both file system events and process creation events.
Detects trojanized 7z.dll loader and encrypted GRAYRABBIT payload components dropped during the UNC3569 exploit chain
Detects trojanized 7z.dll loader and encrypted GRAYRABBIT payload components dropped during the UNC3569 exploit chain
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
Detects RedTail malware samples: UPX-packed, statically linked ELF executables across multiple architectures (x86_64, ARM, ARM64, i686, RISC-V). Requires UPX packing signature to co-occur with RedTail-specific filename strings to reduce false positives on generic UPX-packed binaries.
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Detects KATARU IoT malware samples embedding the DirtyFrag (CVE-2026-43284) Linux local privilege escalation exploit copied from public PoC code, as part of a chained LPE attempt targeting root shell spawning
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects PE binaries masquerading as Microsoft's Windows Update Assistant via forged VersionInfo metadata combined with an unsigned or invalid/unverified digital signature, associated with HVNC backdoor delivery
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects the Warden.dll companion DLL shipped as part of the ShieldCrash (CVE-2026-69414) exploit chain, tightened to require an unsigned/unknown publisher or a suspicious install path alongside the generic filename
Detects the loading of the ProRAM implant DLL (somkernl.dll) when initiated by known sideloading carriers such as 360speedld.exe or SoftupNotify.exe, which are signed utilities frequently abused for this purpose.
This rule monitors endpoint events (file, process, and image load) for a specific malicious MD5 hash or the presence of a specific file name pattern 'Request for Quotation' often used in malicious lures. It provides visibility into potential execution of known malicious payloads.
This rule monitors endpoint events (file, process, and image load) for a specific malicious MD5 hash or the presence of a specific file name pattern 'Request for Quotation' often used in malicious lures. It provides visibility into potential execution of known malicious payloads.
Detects the presence of the known Cyclops Blink implant by file hash (SHA256) on an endpoint, followed by a network connection to associated C2 infrastructure within one hour, aligning with typical implant beaconing or file transfer behavior.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Page 46 of 80