Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects known malware hashes associated with the Iranian APT group Seedworm (aka MuddyWater), including their Dindoor, Fakeset, Stagecomp, and Darkcomp malware families.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects the execution of PowerShell with a command line containing a specific sequence of strings associated with extracting and executing malware from a ZIP file, as observed in the Steam_Monitor campaign. This typically involves using PowerShell commands like 'Get-ChildItem', '::OpenRead', and 'TaR' in conjunction with a '.zip' file.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects the FileZilla executable (filezilla.exe) spawning the C# compiler (csc.exe). This behavior is highly anomalous for a standard FTP client and is a technique used by a trojanized FileZilla variant to perform runtime .NET compilation for its payload.
Detects the full FakeGit infection chain: CMD/BAT launcher spawning LuaJIT with malicious payload argument.
Detects the PLASMAGRID implant and its modules by their SHA-256 hash values. The implant is the final payload of the Coruna exploit kit, designed to steal cryptocurrency and other financial information from compromised iOS devices.
Detects instances of specific legitimate binaries loading known malicious proxy DLLs. This pattern targets the exact sideloading pairs identified in a campaign leveraging a modified Havoc C2 agent.
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
COLDRIVER ROBOT chain - DNS lookup for TI delivery/C2 domains
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Hunts for the specific UNC5142 EtherHiding/CLEARSHORT JavaScript patterns and BSC contract addresses published in the referenced report. This is a high-fidelity content match that is intended for scanning suspicious HTML/JS blobs recovered from compromised web content, web proxies that store bodies, or forensic collections.
This detection is designed to help you find activity related to Intellexa Predator /
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
PREYHUNTER. It is based on the specific threat intelligence in the reference, so it focuses
on concrete, easy-to-verify signals rather than vague patterns. It uses f (unique strings)
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
This rule detects files by their SHA256 hash that are known to be associated with the exploitation of CVE-2026-1731. This includes payloads such as SparkRAT, VShell, and various web shells and droppers.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
Detects the execution of legitimate Windows binaries with command-line arguments containing URL patterns. This is a technique used by the Dohdoor malware campaign to pass C2 information to a sideloaded malicious DLL.
This rule helps identify suspicious repository files that may try to run code automatically when a developer opens a project in an editor or when a build starts. It searches for the exact wording used by the editor to auto run tasks when a folder is opened, and it also looks for a set of web addresses published in public reporting that were used to deliver additional code. A match does not always mean the repository is malicious, but it does mean the file deserves careful review before it is executed on a developer machine. If you see a hit, confirm the repository source, check for unexpected scripts or obfuscated code, and review recent network traffic for connections to the listed staging sites. If the repository is not clearly trusted, isolate the environment, remove the project from production developer workstations, and rotate any secrets that may have been available. This rule is meant to provide a clear and understandable safety check for teams that regularly clone and run new code.
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
Page 167 of 232