Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects malicious process, file, and registry activities associated with Hannibal Stealer staging directories and characteristic command-line execution patterns, specifically targeting indicators like CefSharp.BrowsersSubprocess and specific DLL function delegates used in staging.
Detects suspicious network traffic potentially associated with BeePRAT malware, identified by specific process image paths in temporary or TCC-related directories, connections to known malicious C2 IP addresses/ports, or non-standard TCP communication patterns involving suspicious domain queries.
Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.
Detects the execution of a bash script dropper ('isp.sh') associated with Langflow RCE exploitation (CVE-2026-33017). The rule triggers when command-line arguments indicate an attempt to download and execute the 'lambsys.elf' Go-based cryptominer from a known malicious IP address (83.142.209.214).
Detects outbound network connections from devices to known FortiBleed command and control (C2) servers and sniffer infrastructure IP addresses. This rule helps identify potential compromises involving the FortiBleed vulnerability exploitation.
Detects network activity and command line execution associated with known malicious browser extensions, specifically targeting AdBlock for Youtube-related extensions and associated command-and-control infrastructure.
Detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. This rule helps identify potential compromise or reconnaissance related to the FortiBleed vulnerability.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. Specifically, it looks for PowerShell command or script block execution events containing the string patterns "-bxor[int][char]$" and "[convert]::ToInt32", which are indicative of the custom XOR decryption and type conversion methods employed by this malware distribution framework.
Detects Node.js executing the malicious 'setup.cjs' script with the '--no-warnings' flag. This execution sequence is associated with the 'easy-day-js' typosquat postinstall hook used in the Mastra npm supply chain compromise.
Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the loading of known hooking libraries (MinHook or Microsoft Detours) or SharkLoader-specific components (SyncRes.dat) into non-system processes, followed by the staging of payload components in user directories. This behavior is indicative of malware attempting to intercept critical system APIs (such as VirtualAlloc and Sleep) to evade memory scanning and analysis by EDR solutions.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
Detects anomalous behavior associated with the TrymeLocker watchdog loop, characterized by high-frequency registry modifications to Windows Policy restriction keys paired with rapid mass creation of executable files in common system directories within a short window.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
Detects execution and activity associated with the Grixba infostealer (often linked to Play Ransomware / Jumpy Pisces operations). The rule monitors for the execution of 'GT_NET.exe' from suspicious locations like 'C:\Users\Public\Music\', the loading or creation of the 'inf_g.dll' modular payload, and identifies a specific known Grixba v3 SHA-256 hash.
Detects Reynolds ransomware terminating hardcoded EDR/AV process names via its NSecKrnl kernel driver. The rule identifies process terminations of known security software executables and correlates it with the presence of the '402.sys' driver in the 'C:\ProgramData' folder, which is associated with the NSecKrnl driver used by Reynolds ransomware.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
Detects the execution of Node.js from common user-writable directories like Downloads, TEMP, or APPDATA. This behavior is indicative of malicious implants, such as TonRAT or PureRAT, which often masquerade as legitimate tools or are delivered via phishing campaigns like Photo ZIP ClickFix, where a user is tricked into launching a payload from an untrusted location.
Page 78 of 232