Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
This rule detects the use of the JSON-RPC 'eth_call' method by a non-browser process during network communication. It specifically looks for network connection events where the initiating process is not a common web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting dynamic command or address resolution.
Detects the execution of known Millenium RAT masqueraded binaries (svchost.exe or MsEdgeUpdate.exe) from AppData directories, followed immediately by a PowerShell command to add the root drive C:\ to Windows Defender exclusions. This sequence indicates a malware stage where a RAT attempts to persist and avoid detection by modifying security tool configurations.
Detects network communication associated with BeepRAT malware, specifically targeting hardcoded TCP connections to destination port 18848 and ICMP packets containing the string 'BEEP', which are used for C2 communication and keepalive signals.
Detects SystemBC (Coroxy) malware attempting to establish persistence by writing to Windows Registry Run or RunOnce keys. The rule specifically monitors for registry value names associated with 'socks5' proxy functionality, the presence of 'stmbc.exe' in registry data, or hidden PowerShell command strings often used by the malware for execution.
Detects the suspicious creation of executable files in C:\ProgramData with randomized paths, typically associated with the SystemBC backdoor. The detection rule correlates this file creation event with co-occurring suspicious activities indicative of ransomware operations, such as the creation of known ransomware-related files (e.g., decryptor notes) or signs of lateral movement via non-standard network traffic and SMB activity.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
Detects suspicious process execution patterns where VS Code (code.exe) spawns interpreter processes (node.exe, python.exe) followed by network connections to known staging infrastructure (e.g., jsonkeeper.com, vercel.app). This behavior is characteristic of the 'Contagious Interview' campaign attributed to the Lazarus Group, used to deploy BeaverTail and InvisibleFerret malware following social engineering lures.
This rule identifies suspicious activity involving potential trojanized software installers and connections to known typosquatting or malicious domains. It flags processes spawned by common web browsers that match known malicious installer filenames and monitors for DNS queries to domains frequently associated with software supply chain or distribution-based malicious activity.
Infostealer distributed via fake open-source tool impersonation sites
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Infostealer distributed via fake open-source tool impersonation sites
Photo-themed ZIP phishing campaign dropping a Node.js implant
High-velocity ransomware-as-a-service with aggressive leak-site extortion
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Campaign converting compromised FortiGate firewalls into credential stealers
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Page 70 of 232