Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
Detects Settra ransomware binaries characterized by naming conventions including '_win64.exe', which create 'RESTORE_FILES.txt' ransom notes and use '.locked' or '.locked_wip' file extensions for encrypted data.
This rule detects the presence of files and folders associated with the Rapuncel infostealer malware. It monitors DeviceFileEvents for specific SHA256 hashes known to be malicious, as well as specific file names related to data exfiltration and log collection (e.g., 'browser_decryption.log', 'sends.log'), and the creation of files within folders containing 'Filegraber'.
This rule monitors endpoint telemetry for occurrences of known malicious file hashes, C2 IP addresses, and C2 domains. It aggregates file creation/modification events, process execution, and network connections to detect activity associated with known malicious entities.
This rule detects potential malicious activity by matching endpoint file events against a known list of malicious file hashes (SHA256, SHA1, MD5) and monitoring for connections to known malicious domains or URLs.
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects StealC-related .NET payload protected with ConfuserEx, requiring the sample-specific mutex string, AES key material, and multiple anti-debugging indicators together to avoid matching benign ConfuserEx-obfuscated applications
Detects StealC-related .NET payload protected with ConfuserEx, requiring the sample-specific mutex string, AES key material, and multiple anti-debugging indicators together to avoid matching benign ConfuserEx-obfuscated applications
Detects StealC-related .NET payload protected with ConfuserEx, requiring the sample-specific mutex string, AES key material, and multiple anti-debugging indicators together to avoid matching benign ConfuserEx-obfuscated applications
Detects known PowerShell dropper and embedded StealC payload binaries used in the ClickFix infection chain via exact SHA256 hash equality only
Detects embedded CVE-2026-46300 (Fragnesia) Linux privilege escalation exploit code used by KATARU IoT malware, copied unmodified from public PoC
Detects the presence of QuasarRAT-related processes combined with the creation of known log filenames associated with its keylogging functionality.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
Detects the presence of PHP web shell code within specific versions (2.35/2.36) of the Admin Menu Editor Pro plugin. This rule targets malicious files introduced via a supply chain compromise of the plugin's update distribution channel, specifically looking for common PHP obfuscation and execution functions associated with web shells.
Detects outbound network traffic from internal hosts to the known MoneroOcean mining pool over TLS (port 443). This behavior is indicative of XMRig or other cryptomining software communicating with a mining pool to exchange job data, often a sign of unauthorized resource hijacking.
Detects the deployment and activity of SilkParasite-associated Linux threats, including XMRig cryptocurrency miner shell scripts and standalone Meterpreter agents. The rule also captures the execution of a custom Python fleet-scanning tool used to interact with exposed Redis instances for unauthorized command execution and infrastructure management.
Detects the presence of XMRig cryptocurrency miner ELF binaries by scanning for unique structural strings and configuration flags indicative of XMRig operations. This rule uses YARA to inspect binary file contents, enabling detection of miners regardless of their on-disk filename or obfuscation techniques such as hiding them within dotfiles.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Page 39 of 232