Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects attempts by a user or process to disable or modify Linux kernel-level mandatory access control mechanisms, specifically SELinux and AppArmor. Such actions are commonly performed by adversaries to reduce system security posture and facilitate further malicious activity by bypassing enforced containment policies.
Detects memory writes to ntdll.dll's NtTraceEvent function patched with a single RET (0xc3) byte, disabling ETW-based tracing across the host — a precision anti-forensics technique used by the SilverFox loader chain.
Modular remote access trojan associated with long-term espionage intrusions
Loader used in click-hijacking traffic distribution scheme
USB worm and loader leveraging living-off-the-land binaries
Malvertising loader delivering CastleStealer via malicious Google Ads
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lightweight remote access trojan deployed in recruiter-themed social engineering
High-velocity ransomware-as-a-service with aggressive leak-site extortion
IoT botnet malware family used for DDoS and proxy infrastructure
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Fraud framework powering scam domains for crypto and gambling schemes
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
This rule detects the execution of 'wermgr.exe' from a path other than the expected 'C:\Windows\System32'. This behavior is indicative of the 'RoguePlanet' exploit, where an adversary replaces a Windows Defender quarantine artifact with a malicious payload and triggers it via the 'QueueReporting' scheduled task, running with NT AUTHORITY\SYSTEM privileges.
Page 43 of 52