Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects BadIIS malware variants associated with the 'Operation Rewrite' campaign (CL-UNK-1037). This rule identifies the native IIS module, PHP backdoors, and other related components used for SEO poisoning.
Detects AdaptixC2 beacon (PE) and shellcode loader components based on unique code patterns and API hashes.
Yara rule that detects PondRAT backdoor.
Detects the malicious telemetry.js file used in the s1ngularity supply chain attack. This script harvests sensitive developer assets and exfiltrates them to attacker-controlled GitHub repositories.
This rule identifies potentially suspicious signed binaries by looking for files with digital signatures from signers that are not commonly known or trusted vendors. It aims to detect the abuse of code signing certificates by threat actors to bypass security controls, leveraging the trust associated with digital signatures. The rule explicitly excludes a list of well-known and trusted software vendors to reduce false positives.
Yara rule that detects Pumakit rootkit.
Detects the execution of a Bumblebee loader variant which uses rundll32.exe to launch its malicious DLL. This is immediately followed by the spawning of common reconnaissance commands to gather information about the compromised system and domain. This TTP was observed in the attack chain leading to Akira ransomware.
RAR SFX-based dropper that extracts a JS payload (DarkWatchman-style)
ICEEVENT: MSVC x64 thunk/prologue patterns + distinctive 'Servcie' error strings
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
This query visualises the amount of total Malware detections of files located on SharePoint, OneDrive and Teams, summarizing by the workload in which they are stored
This query visualises total Malware detections of files located on SharePoint, OneDrive and Teams over time summarizing the data by the various Malware families detected focusing on Defender for Office 365 detections (detonations)
Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
Yara rule that detects ChaosRAT backdoor.
Page 75 of 80