Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Detects a suspicious execution chain where a PyInstaller-compiled loader named 'start.exe' spawns 'BQT.exe', which is the identified payload for the BQTLock (BaqiyatLock) ransomware. The rule monitors for process launch events where these specific filenames appear in a parent-child process relationship.
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
This rule detects the presence of known ShadowAgent malware files on devices by matching their SHA256 hashes. It queries 'DeviceFileEvents' to identify any files with SHA256 hashes that are part of a predefined list associated with ShadowAgent.
This rule detects the presence of MicroStealer malware by matching known MD5, SHA1, or SHA256 hashes of its binaries against file events on monitored devices. MicroStealer is a credential stealer that targets various applications to exfiltrate sensitive information.
Page 85 of 232