Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the invocation of an unimplemented keylogger command placeholder (key '11') within the GigaWiper malware. This indicates an attempt to trigger a command that the malware is not currently configured to execute, often used for debugging or malicious functionality activation.
This YARA rule detects specific macOS malware components associated with the threat actor Citrine Sleet (AppleJeus) by matching static dylib and entitlement hashes. It targets identified malicious payloads including UpdateAgent, SimpleTea (POOLRAT), and CrashReporter to track the group's tooling.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
Detects dropped builder/README/config files from underground Ransomware-as-a-Service kits bundling FUD AES-256 crypters, private stubs, decrypters, and key generators for Windows 10/11 ransomware payloads
This rule detects the presence of the GodDamn ransomware encryptor on a host by identifying the specific binary filename (encrypter-windows-gui-x86.exe), its known SHA256 hash, or the presence of the .God8Damn file extension commonly associated with files encrypted by this malware.
Detects the presence of the PoisonX malicious kernel driver (g11.sys), which is used by the Hyadina group in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software and disable user-mode API hooks.
This rule detects the presence of Remcos Remote Access Trojan (RAT) by matching known malware family signatures identified by antivirus software. Remcos RAT is frequently used by adversaries for unauthorized system control, data exfiltration, and surveillance.
This rule detects potential information stealing activity by identifying either known StealC payload hashes or unauthorized processes spawned by PowerShell accessing web browser credential files (e.g., Login Data, Cookies, Local State). This is often associated with ClickFix or similar delivery mechanisms where an attacker uses PowerShell to stage sensitive browser data for exfiltration.
This YARA rule detects the SugarWraith loader, a malware component identified by the presence of specific diagnostic strings, system enumeration artifacts, and indicators of persistence or configuration related to tunnel bypass tools like ngrok. It specifically targets Windows-based binaries that exhibit characteristics associated with the UNK_SweetSpector threat activity.
ROOT SUTERUSU
YARA
This YARA rule detects the presence of Suterusu rootkit source code artifacts, specifically targeting header files, function names, and print strings used for rootkit operations such as process/file/port hiding and module loading manipulation.
Detects instances of Node.js processes executing command-line instructions related to publishing packages (npm, twine, or cargo). This behavior is characteristic of Miasma malware's 'trySpread' routine, which attempts to propagate the malware by leveraging compromised package repository tokens.
Detects a malicious binary masquerading as a Symantec executable (symantec.exe) staged in the user's Music directory. The rule triggers on a known file hash or the combination of the specific filename and file path, indicative of a dropper attempting to install the PoisonX kernel driver.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects process, named pipe, or mutex events that contain the specific string 'BEAST HERE?', which is often associated with the presence of malicious tools or backdoors using this hardcoded string for identification or synchronization.
Detects self-narrating LLM-generated ransomware payload artifacts referencing ransom infrastructure and encryption routines (JadePuffer)
Detects SHARDLOADER/ZOHOMURK/MINIRECON related loader DLL via embedded mutex name, XOR key, staging file paths, and exported function used in Mustang Panda campaigns
Detects known malicious indicators, including C2 domain connections, suspicious file hashes, and specific mutexes often associated with malware execution.
Page 65 of 232