Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
426 detections
Filters
Last updated
All Time
Detection languages
199
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
422
3
1
1
Products / Services
179
159
26
18
16
MITRE Techniques
404
336
220
96
94
CVEs
2
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lightweight remote access trojan deployed in recruiter-themed social engineering
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Fraud framework powering scam domains for crypto and gambling schemes
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
Page 15 of 21