Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,665 detections
Filters
Last updated
All Time
Detection languages
713
606
71
56
52
Contributors
726
301
301
80
71
Categories
20,443
11,831
5,872
5,155
4,866
1,665
Platforms
1,486
238
159
39
18
Products / Services
645
258
183
65
49
MITRE Techniques
639
583
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects PHP scripts that masquerade as WordPress cache classes but contain functionality for decrypting commands using AES-256-CBC and executing them via shell_exec. The detection identifies the presence of hardcoded encryption keys, use of php://input, and common PHP obfuscation/encryption methods alongside shell execution functions.
Detects the ProRAM macOS ARM64 Mach-O implant, identified by specific internal codesign strings, download URLs (cloudfront.net/helper), and local file drop paths ($HOME/updated) consistent with the Funnull threat actor's activity.
Matches known malicious dlp.sh/dlp-docker.sh Terraform module scripts used in Coder registry supply chain attack (common, aider, rstudio-server, windows-rdp, zed variants)
Detects cached malicious dlp.sh/dlp-docker.sh Terraform module artifacts served from the compromised registry.coder.com infrastructure
Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.
Detects a hardcoded PEM RSA public key embedded alongside JSCeal-specific compiled V8 bytecode obfuscation artifacts, used to encrypt exfiltrated data or C2 communications
Detects known malicious file hashes for GRAYRABBIT delivery chain components: trojanized 7zp.dll loader, encrypted PE loader shellcode, and GRAYRABBIT backdoor core.dll, gated on PE structural validity and filesize
Detects known malicious file hashes for GRAYRABBIT delivery chain components: trojanized 7zp.dll loader, encrypted PE loader shellcode, and GRAYRABBIT backdoor core.dll, gated on PE structural validity and filesize
Detects trojanized 7z.dll loader and encrypted GRAYRABBIT payload components dropped during the UNC3569 exploit chain
Detects UNC3569/GRAYRABBIT shellcode combining call/pop self-location, PEB InLoadOrderModuleList walk, and the specific XOR-then-ROR8 export-name hashing loop observed in the GRAYRABBIT loader chain, requiring multiple distinctive elements together to reduce false positives on generic shellcode idioms
This rule monitors for two distinct indicators of compromise: it detects the execution of files dropped into specific patterns within the 'AppData\Roaming' directory (associated with potential GoCaracal malware) and identifies network connections to known C2 infrastructure associated with GoCaracal and Bandook malware families.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
This rule detects potentially malicious activity associated with removable media (USB drives) by identifying two distinct patterns: first, the creation of an 'autorun.inf' file on a removable drive followed by the execution of a script or executable from that same drive shortly after. Second, it identifies executables appearing on removable media that are launched across multiple distinct hosts within a one-hour window, which may indicate worm-like spreading or mass-malware distribution via portable storage.
This rule detects potentially malicious activity associated with removable media (USB drives) by identifying two distinct patterns: first, the creation of an 'autorun.inf' file on a removable drive followed by the execution of a script or executable from that same drive shortly after. Second, it identifies executables appearing on removable media that are launched across multiple distinct hosts within a one-hour window, which may indicate worm-like spreading or mass-malware distribution via portable storage.
This rule detects potentially malicious activity associated with removable media (USB drives) by identifying two distinct patterns: first, the creation of an 'autorun.inf' file on a removable drive followed by the execution of a script or executable from that same drive shortly after. Second, it identifies executables appearing on removable media that are launched across multiple distinct hosts within a one-hour window, which may indicate worm-like spreading or mass-malware distribution via portable storage.
This rule detects the presence or execution of a file named 'GlobalProtect.exe' within the Palo Alto GlobalProtect directory. It focuses on identifying potentially masqueraded or unauthorized binaries by monitoring file events and associated process execution. This pattern is commonly used by attackers to disguise malicious files as legitimate security software to evade detection.
Page 48 of 80