Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Modular remote access trojan associated with long-term espionage intrusions
Loader used in click-hijacking traffic distribution scheme
USB worm and loader leveraging living-off-the-land binaries
Infostealer distributed via fake open-source tool impersonation sites
Malvertising loader delivering CastleStealer via malicious Google Ads
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lightweight remote access trojan deployed in recruiter-themed social engineering
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
AI-powered phishing-as-a-service abusing device-code authentication
Page 34 of 55