Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
ET ATTACK_RESPONSE ClickFix Related Payload Inbound
ET ATTACK_RESPONSE ClickFix Webpage Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE Observed VBScript Payload Downloader Inbound
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Detects a process accessing multiple files related to known cryptocurrency wallets or browser extensions. This behavior is indicative of information stealers like LeakyStealer attempting to exfiltrate sensitive wallet data.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shop)
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
Page 183 of 232