Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Latin American banking trojan using DLL side-loading and overlay attacks
Detects suspicious execution of .scr (screensaver) files, execution of 'SecureMessage' named executables (potentially Pony malware), and email attachments containing .scr or .zip files, which are common vectors for malware delivery.
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Fraud framework powering scam domains for crypto and gambling schemes
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
Banking trojan and loader using malicious Office macro delivery
Page 83 of 232