Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
Detects network beaconing activity associated with the Sauron Loader malware. The rule monitors HTTPS traffic for specific domain patterns and suspicious TLV (Type-Length-Value) protocol structures, as well as recurring beaconing cadence to identified C2 infrastructure.
Detects known samples of the Atomic Stealer (AMOS) malware on macOS, specifically those associated with the Macfinger/ClickFix campaign, by matching their SHA256 hashes.
Detects unpacked Sauron Loader DLL samples by identifying a specific embedded configuration header (magic 0xbaadf00d) followed by RSA key material length fields. This indicates the presence of malicious configuration structures associated with the Sauron Loader malware.
Detects the presence of Sauron Loader by matching known SHA-256 hashes of the MSI installer and associated side-loaded DLLs, or by identifying malicious PE files containing the 'Sauron' string.
Detects specific file hashes associated with Atomic macOS Stealer (AMOS) Mach-O payloads, which are often delivered via staging scripts on macOS systems.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
This rule detects known command-and-control (C2) domains associated with the Sauron Loader malware family, specifically by inspecting TLS Server Name Indication (SNI) fields. It also monitors for patterns of repeated connections to domains prefixed with 'api.' over established TLS sessions, which may indicate beaconing behavior characteristic of C2 activity.
Detects the download and presence of the Atomic macOS Stealer (AMOS) payload, a 64-bit Mach-O executable, identified by specific file hashes or internal file structure characteristics (Mach-O magic bytes) within a specific file size range.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects the download and presence of the Atomic macOS Stealer (AMOS) payload, a 64-bit Mach-O executable, identified by specific file hashes or internal file structure characteristics (Mach-O magic bytes) within a specific file size range.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Comprehensive IOC sweep across endpoint file/process/network telemetry for the full set of known SilkParasite/SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy infrastructure indicators reported by Hunt.io and Security Affairs: all listed C2/decoy/certificate-hosting IPs, all listed spoofed/infrastructure domains, and known file/certificate hashes (SHA256, SHA1).
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
This rule detects the LausivLoader initial-stage obfuscated JavaScript dropper. It identifies the malware either by specific file hashes (MD5/SHA256) or by detecting characteristic behaviors: small file size (<1MB), the presence of 'String.fromCharCode' obfuscation techniques, excessive junk comments, and supply-chain related lure strings.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects the execution of RatHat, a Go-based Android native daemon masquerading as 'liblocal-service.so'. The rule identifies the malware's use of ADB-derived shell commands to bypass Android Doze mode, prioritize background execution, and tamper with installed applications via pm (package manager) commands.
Page 30 of 232