Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
10
7
2
1
1
Contributors
21
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
10
7
3
1
Products / Services
5
3
3
2
2
MITRE Techniques
13
5
5
4
4
CVEs
3
3
2
IDS Classtypes
1
IDS Protocols
1
Correlates a Sysmon DriverLoad event matching known BTR.sys hashes with a subsequent System-process (PID 4) deletion of specific Defender binaries or WdFilter/WinDefend registry keys within a 10-second window — the definitive Defender self-destruction signature of the kernel primitive.
Detects Mach-O binaries embedding XMRig/Monero mining strings together with stratum mining protocol URIs and typical miner CLI flags, consistent with Monero miners dropped and executed as root following macOS Screen Sharing compromise.
Detects the BYOVD kill chain for the DCRCVDrv.sys driver: drop to C:\Windows\Temp\, DCRCVDRV_U/LEGACY_DCRCVDRV_U service installation, device open, and IOCTL 0x2205c0 invocation used to terminate security/EDR processes from kernel context.
Detects execution of Monero mining indicators by a root-privileged process descended from screensharingd or its file-copy helpers, within 30 minutes of a Screen Sharing session on the host.
Detects repeated screensharingd crash/restart cycles tightly time-correlated with file-copy helper activity, indicating CVE-2026-43777 DoS exploitation alongside its secondary file-copy abuse potential.
Detects the LockScreen component blocking user input and displaying a full-screen StopAndProtect ransom note referencing Telegram/BTC payment.
Detects bursts (3+ within 10 minutes) of screensharingd crash/respawn or anomalous child-process events consistent with the CVE-2026-43777 denial-of-service condition, excluding OS update/boot windows.
Detects SilentEncryptor ransomware by correlating Encryptor.exe execution with a mass file-rename burst and creation of encrypted_files_V/encryption_log_V artefacts.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects sustained outbound Stratum mining-protocol connections to Monero mining pools from a compromised host (5+ connections within 5 minutes), consistent with post-exploitation cryptomining following Screen Sharing compromise.
Detects a process other than Claude Code or a recognized backup/editor/IDE tool writing to a Claude project's durable MEMORY.md file, indicating unexpected tampering with the coding agent's persistent memory store.
Detects a single masquerading Kimwolf v7 binary (netd_service, TVHelper, or libdevice.so running from a disguised com.n2.systemservice path) generating at least three distinct flood traffic patterns (UDP game-protocol flood, DNS query flood, or TLS/HTTPS flood) within a 60-second window, indicative of active multi-vector DDoS command execution.
Flags modifications to the Windows hosts file made by an unsigned process or a process freshly dropped in a temp folder within the last 10 minutes, consistent with Abyssos's DNS_ADD/DNS_DEL hosts-file manipulation.
Detects mass file renaming (ransomware-style encryption behavior) within 30 minutes after execution of Phantom Mantis EDR-killer tooling, indicating endpoint defenses were pinned immediately before ransomware deployment.
Detects a user-mode caller sending IOCTL 0x2220E0 to a loaded kernel driver, triggering an attempted system reset via the 8042 keyboard controller.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects connections to the local CDP WebSocket server on port 18907 tied to the chrome_remote/browser_remote backdoor family, used for session-cookie theft, password capture, browser API hooking, and MetaMask/dApp manipulation.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.
Detects [embed] shortcode content submitted to WordPress that references invalid or anonymous local post IDs, used in the wp2shell chain to forge oEmbed cache database rows as a render-time write primitive.