Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.
Detects the presence of malicious artifacts associated with the RoguePlanet campaign by ShinyHunters and Chaotic Eclipse, including specific malware families (BlueHammer, RedSun, UnDefend, Bluekit) and libpwn exploit harness components related to CVE-2026-55200.
Detects the Miasma malware attempting to enumerate installed developer and AI coding tools by executing version-check or help commands. The rule monitors for a pattern of 5 or more child process executions from 'node.exe' or 'bun.exe' within a 30-second window, which targets tools like VS Code, Cursor, Claude, AWS CLI, kubectl, helm, npm, git, and docker.
Detects the loading of 'mscoree.dll' or 'msvcp140.dll' from the 'C:\ProgramData\' directory by processes masquerading as '.NET Runtime Optimization Service' or originating from a highly suspicious, obfuscated folder path. This behavior is indicative of malware attempting to evade detection through DLL side-loading or process masquerading, as legitimate .NET Runtime Optimization Service processes should not load these DLLs from this location or from such unusual paths.
Modular remote access trojan associated with long-term espionage intrusions
IoT botnet malware family used for DDoS and proxy infrastructure
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
High-velocity ransomware-as-a-service with aggressive leak-site extortion
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
USB worm and loader leveraging living-off-the-land binaries
Malvertising loader delivering CastleStealer via malicious Google Ads
Loader used in click-hijacking traffic distribution scheme
Malvertising loader delivering CastleStealer via malicious Google Ads
Modular remote access trojan associated with long-term espionage intrusions
USB worm and loader leveraging living-off-the-land binaries
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Page 74 of 232