Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects unauthorized executables masquerading as XDR agents (Palo Alto Networks) or VMware tools (XDRAgent.exe, vmtools.exe, vmwared.exe) by executing from suspicious directories such as AppData, Temp, or ProgramData\VMware instead of authorized installation paths. This technique is often used to hide the execution of malicious tools like reverse tunnel clients or VPN utilities.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Infostealer distributed via fake open-source tool impersonation sites
Loader used in click-hijacking traffic distribution scheme
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Campaign converting compromised FortiGate firewalls into credential stealers
Loader malware delivering follow-on ransomware payloads
Ransomware group exploiting edge devices and managed file transfer software
Detects the execution and download of the 'isp.sh' shell dropper and the 'lambsys' Go-based cryptominer binary on Linux systems. This rule monitors for common dropper patterns, including shell execution of piped commands, use of curl/wget to fetch known malicious components, and instances where Langflow processes attempt to spawn shell-related child processes for potential payload execution.
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious locations such as Downloads or Temp folders with high integrity level, which is characteristic of masquerading techniques used by adversaries to hide malicious activity as a legitimate system process.
This rule detects the presence of known LokiBot packed binaries by matching the SHA256 hashes of staged memory section bins that were recovered during unpacking analysis. This indicates a high-confidence match for known malicious samples associated with the LokiBot information stealer.
This rule detects instances of specific DLLs (Qt5Core.dll or opera_elf.dll) being loaded by known suspicious executables (WizardDa42.exe or AlphVector.exe) from non-standard, potentially user-writable directories like ProgramData or Temp. The rule further filters to include instances where the module's signature is invalid, unsigned, or untrusted, which is characteristic of malicious process masquerading or side-loading.
Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.
Detects the presence of the Montana Empire phishing kit within ZIP archives. The rule identifies specific PHP backend components (mentalite.php, panel_track.php, verify_api.php) often used for credential harvesting, along with unique branding strings and artifacts suggesting AI-assisted development of the phishing kit.
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Page 59 of 80