Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.
Detects the presence of files known to be associated with malicious activity by matching their SHA256 hashes against a list of known bad indicators.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of the ErrTraffic webshell activity.
macOS malware used by JINX-0164 against cryptocurrency developers
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
This rule detects the presence of known malicious drivers (hlpdrv.sys, rwdrv.sys) by their SHA256 hash or file path. It also identifies attempts to install these drivers via service creation commands and monitors for modifications to Windows Defender registry keys that could disable its functionality, indicating defense evasion.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Page 76 of 232