Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
Latin American banking trojan using DLL side-loading and overlay attacks
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Form-grabbing and credential stealing malware-as-a-service
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Detects anomalous activity associated with 'winupdate.exe', including suspicious registry run key persistence, execution from abnormal directories (e.g., AppData, .cache), and unauthorized outbound network connections to Pastebin. The rule triggers when multiple signals are observed from the same host and user, indicating potential malware behavior.
Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.
Page 134 of 190