Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the execution of the TinyRCT backdoor, which attempts to masquerade as the legitimate PerfWatson2.exe binary. The detection focuses on the process running from the AppData/Local directory, a common location for user-level malicious payloads.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects the presence of malicious artifacts associated with the RoguePlanet campaign by ShinyHunters and Chaotic Eclipse, including specific malware families (BlueHammer, RedSun, UnDefend, Bluekit) and libpwn exploit harness components related to CVE-2026-55200.
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Malvertising loader delivering CastleStealer via malicious Google Ads
Loader used in click-hijacking traffic distribution scheme
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Photo-themed ZIP phishing campaign dropping a Node.js implant
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Cloud extortion group exploiting exposed credentials and storage
Campaign converting compromised FortiGate firewalls into credential stealers
Latin American banking trojan using DLL side-loading and overlay attacks
Campaign converting compromised FortiGate firewalls into credential stealers
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Form-grabbing and credential stealing malware-as-a-service
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Page 60 of 80