Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Rust-based ransomware family targeting enterprise environments
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
Page 84 of 232