Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,469
11,856
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the Yuta/Glove Stealer malware (winupdate.exe) performing environment checks by querying Windows registry keys associated with virtualization software (VMware, VirtualBox, QEMU). This behavior is indicative of sandbox evasion techniques used to detect analysis environments before executing secondary payloads.
Detects execution of the Payouts King ransomware by identifying malicious process hashes, the use of a specific CRC-gated command-line parameter '-i', and the use of cmd.exe for malicious pipe redirection, which is a technique used to issue tasks without leaving direct process lineage.
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
Detects execution patterns associated with Payouts King malware, characterized by specific command-line arguments, obfuscated execution flags, and execution from suspicious directories like Temp, AppData, or ProgramData. The rule uses a scoring mechanism to identify malicious behavior, including checking against known malicious SHA256 hashes.
Detects HTTP POST beaconing behavior to known infrastructure associated with Atlas RAT and ValleyRAT malware, linked to TA4922 campaigns. The rule monitors for repeated connections to specific C2 IP addresses on TCP port 886.
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Page 102 of 232