Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,051 detections
Filters
Last updated
All Time
Detection languages
502
165
77
75
69
Contributors
326
184
158
51
46
Categories
20,443
11,831
5,872
5,155
4,866
1,051
Platforms
927
119
22
11
4
Products / Services
408
280
229
193
114
MITRE Techniques
1,017
1,001
877
614
181
CVEs
2
1
1
1
1
IDS Classtypes
5
4
2
1
IDS Protocols
8
4
Lightweight remote access trojan deployed in recruiter-themed social engineering
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Rust-based macOS infostealer implant embedding prompt injection payloads
Form-grabbing and credential stealing malware-as-a-service
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
Detects the creation of scheduled tasks using schtasks.exe where the command points to payloads residing in user-writable directories such as AppData or Temp. This behavior is indicative of TA4922 malware (e.g., Atlas RAT or RomulusLoader) establishing persistence. The rule excludes common installers and trusted publishers to reduce false positives.
Detects the creation of scheduled tasks that contain indicators related to QEMU virtualization software (e.g., binaries, disk images) or tasks created by web server processes. This behavior is often associated with adversary attempts to establish persistence, hide malicious activity within VM environments, or execute payloads following exploitation of a web application.
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Page 33 of 51