Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
7
Contributors
7
Categories
20,453
11,838
5,876
5,154
4,865
Platforms
5
4
1
Products / Services
1
1
1
1
1
MITRE Techniques
2
2
1
1
1
CVEs
1
Detects Mach-O binaries embedding XMRig/Monero mining strings together with stratum mining protocol URIs and typical miner CLI flags, consistent with Monero miners dropped and executed as root following macOS Screen Sharing compromise.
Detects BeaverTail malware deployed via PurpleDelta/PurpleBravo coordination; requires multiple occurrences of the distinctive BeaverTail string to reduce false positives
Detects the navi_the_clown macOS Screen Sharing pre-auth RCE PoC binary via hash/filename/command-line flag or, as a lower-confidence secondary indicator, codesign+xattr Gatekeeper-bypass staging correlated with the PoC filename or flags
Detects C2Looper Rust-based backdoor by requiring at least 3 of 4 weak indicator categories: dynamic API resolution artifacts, v2 debug string, PE section layout, and Rust runtime strings; known hash is an optional fast-path only
Detects JWR phishing framework client engine script via known SHA256 hashes (standalone high-confidence), or the co-occurrence of anti-debug check, staging path structure, and Simplified Chinese operator status strings
Detects PyArmour-obfuscated PyInstaller backdoor binaries associated with STAC4749 that stage base_library.zip and communicate with workers.dev C2 infrastructure
Detects known STAC4749 backdoor, loader, implant, and reverse SOCKS proxy binaries via SHA256 hash match