Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects PowerShell being used with an encoded command that contains download and execution primitives. This is a common technique used by adversaries, including in the exploitation of CVE-2025-55182 (React2Shell), to download and run second-stage payloads in memory.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
Detects the creation of malicious DLL files used for side-loading by the Ashen Lepus group's AshTag malware suite. These DLLs are often dropped in non-standard locations to be loaded by legitimate executables.
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
Detects process execution from a deeply nested path containing a long sequence of underscores, a technique used by the ValleyRAT campaign to hide malicious components.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Detects the creation or modification of files with SHA256 hashes known to be associated with the Shai-Hulud 2.0 npm supply chain attack campaign. This rule specifically looks for file creation or renaming events where the SHA256 hash of the file matches a predefined list of malicious hashes.
Detects the presence of malicious Microsoft Edge add-on IDs associated with the ShadyPanda campaign. These extensions are part of an active spyware operation affecting millions of users by exfiltrating browsing history, search queries, and other sensitive data.
Detects the presence of malicious Google Chrome extension IDs associated with the ShadyPanda campaign. These extensions can act as a backdoor, enabling remote code execution and data exfiltration.
Detects the use of certutil.exe to decode a payload from a file with a misleading extension (e.g., .png) and save it as a DLL in a suspicious location. This technique was observed in the 'Operation Hanoi Thief' campaign.
Detects the presence of a unique build path artifact associated with the PREYHUNTER iOS spyware stager, used by the commercial surveillance vendor Intellexa.
Detects network traffic to infrastructure associated with newly identified front companies linked to the Intellexa Predator spyware syndicate.
Detects the PREYHUNTER 'watcher' module performing anti-analysis checks by launching common security, forensic, or shell tools.
Detects network traffic to domains associated with Intellexa front companies, such as Pulse Advertise and MorningStar TEC, which are linked to the 'Aladdin' zero-click infection vector. This vector abuses the digital advertising ecosystem to deliver Predator spyware.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
Page 178 of 232