Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects execution of processes associated with Grixba malware (GT_NET.exe) or suspicious attempts to clear Windows event logs using built-in utilities (wevtutil, wmic) in conjunction with common command shells or the malware itself.
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Detects the Yuta/Solara .NET WPF dropper (SLaunch.exe) executing the staging phase of a PyInstaller-compiled Python stealer (winupdate.exe) into the %APPDATA%\.cache directory, as observed in the Glove Stealer campaign.
This rule monitors for two high-confidence indicators of malicious activity: the execution of known Payouts King ransomware binaries and the termination of security software processes by non-system actors, which is indicative of defensive evasion techniques such as syscall abuse.
Detects execution patterns associated with the BQTLock ransomware, specifically the PyInstaller-packaged 'start.exe' binary acting as a loader to spawn 'BQT.exe' or other child processes, identified by specific PyInstaller environment artifacts in the command line.
This rule detects the BQTlock ransomware behavior of capturing desktop screenshots using suspected malicious processes ('BQT.exe', 'start.exe') and attempting to exfiltrate the captured data via the Telegram API using 'sendPhoto' or 'sendDocument' commands.
macOS malware used by JINX-0164 against cryptocurrency developers
Page 71 of 232