Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound
Detects the execution of the Supper SOCKS5 backdoor, used by the Vanilla Tempest threat actor, based on a unique command-line pattern involving DllRegisterServer and a .ULB file, which acts as a loader for the obfuscated payload.
Detects the creation of potential LANDFALL spyware delivery files. These are malformed DNG image files, often with filenames suggesting delivery via WhatsApp, used to exploit CVE-2025-21042.
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (taskrunnersrvmod .com)
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound
Detects suspicious behavior where a Node.js-based application launches cmd.exe to query MachineGuid from the registry, indicating potential fingerprinting or persistence activity by EvilAi malware. The rule specifically looks for processes initiated from a suspicious folder path, where node.exe is the parent process, and cmd.exe is used to query 'HKLM\Software\Microsoft\Cryptography' for 'MachineGuid'.
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (buildtoolsrvcore .com)
This rule detects suspicious WebAssembly (WASM) code in HTTP responses that indicates the allocation of Read-Write-Execute (RWX) memory pages. This pattern is a common precursor to shellcode execution within a web browser, often used by exploit kits or malicious websites to achieve arbitrary code execution. The rule specifically looks for JavaScript code that initializes a WebAssembly module with a byte array containing specific patterns indicative of RWX memory allocation, followed by instantiation and export calls.
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET MALWARE MEOWBACKCONN CnC Checkin
Detects network communication patterns associated with the LANDFALL Android spyware C2 servers. This includes connections to known malicious domains/IPs and specific HTTP POST requests used for beaconing.
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET MALWARE Observed DNS Query to Malicious Domain (significant-adopted-bearing-own .trycloudflare .com)
Page 182 of 232