Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
This rule detects the presence of unauthorized WebView or HTML overlay windows rendered on top of active banking applications on Android devices. This behavior is indicative of credential-theft malware, such as banking trojans, which use overlays to capture user input, including banking credentials, while masking their activity over legitimate finance-related applications.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.
Detects artifacts associated with the CRUDEEXCLUDE Delphi-based loader, which is used to deploy the HEAVYGRAM backdoor. The rule identifies a combination of Delphi indicators, anti-analysis sandbox connectivity checks, decoy message boxes, and attempts to modify Windows Defender exclusions for specific paths associated with the malware's activity.
Detects the execution of known malicious loader files associated with the MovieReaper campaign. The rule identifies processes based on specific MD5 hashes, or by detecting obfuscated naming conventions where an executable file is disguised as a movie file by appending excessive padding or specific descriptors to the filename, often used to bypass user suspicion when distributed via torrent repositories.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
Detects files containing specific structural footers (537 bytes) and RSA key generation strings commonly associated with ransomware encryption. The footer indicates the use of RSA-4096 to encrypt files, with modes for full, striped, or header-only encryption patterns.
Detects HTTP GET requests characteristic of SilverFox malware final-stage payload delivery. The rule monitors for requests to known C2 domains or domains using a specific naming pattern (www.[5-10 chars].com) with specific URI paths (down, load, or insdw followed by 2-4 digits), indicating the retrieval of a malicious payload.
Detects network activity associated with the 'SilverFox' malware family's command-and-control relay dispatcher. The rules identify specific HTTP requests to 'api.php', responses containing 'download_link', and the serving of legitimate WeChat installer payloads as a fallback mechanism for evasion, including the use of cache-busting parameters.
Detects execution of the MovieReaper initial loader binary. This malware employs advanced anti-analysis techniques, specifically manual PEB-walking to resolve APIs and evade detection by standard library loading hooks. The rule alerts on known file hashes and specific masquerading filenames.
Page 40 of 232