Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Rust-based macOS infostealer implant embedding prompt injection payloads
Cloud extortion group exploiting exposed credentials and storage
Latin American banking trojan using DLL side-loading and overlay attacks
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
Form-grabbing and credential stealing malware-as-a-service
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
This rule detects the creation or execution of files named 'winupdate.exe' and specific patterns of Python script execution within user-writable 'AppData' subdirectories, specifically targeting the '.cache' folder. This behavior is indicative of potential malware staging or execution, often associated with obfuscated payloads or unauthorized software running in non-standard user locations.
Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Page 67 of 80