Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,468
11,855
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Detects a payload aggressively accessing browser credential stores (Login Data, Cookies, Web Data) in a rapid sequence, specifically when initiated by processes matching common VPN client names like GlobalProtect or AnyConnect. This behavior is indicative of infostealer activity, attempting to exfiltrate sensitive browser data.
This rule detects suspicious activities commonly associated with the Yuta/Glove information stealer, including the creation of specific file paths in AppData, the execution of binaries from user-writable directories, and potential process hollowing or side-loading behaviors. It monitors process creation (Event ID 1) and file creation (Event ID 11) for indicators like winupdate.exe, PyInstaller-related temporary directories, and known malicious file hashes.
Page 101 of 232