Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
This rule detects phishing attempts related to a Booking.com campaign. It identifies suspicious URLs containing 'op_token' or 'tpo_token' parameters, often combined with paths like 'complaint' or 'reserv', on non-Booking.com domains. It specifically looks for punycode domains (e.g., 'xn--*'), lookalike domains (e.g., '*booklng*', '*mgmnt*', '*portal*'), and specific high-signal punycode domains identified in reports. The rule also includes a pattern for partner kit redirect URLs with 'tpo_token' on 'booklng' subdomains. Additionally, it suggests looking for specific email patterns from Gmail senders with subjects like 'Automatic reply', 'Availability', or 'Reservation' that contain embedded URLs matching 'complaint?op_token='.
This rule detects indicators associated with the RenEngine campaign, which involves the deployment of HijackLoader, Lumma Stealer, and ACR Stealer. Detection is based on specific MD5 hashes of known malicious files, filenames used in the campaign, and command and control (C2) domains identified as part of the infrastructure.
Detects execution of a suspicious payload from common staging locations used in multi stage campaigns.
Detects execution of processes with filenames referenced in GRIDTIDE reporting, such as xapt and related components.
The rule detects the creation of processes that utilize specific mutex names ('BOGLVGAU') known to be associated with HijackLoader malware activity. This detection is based on monitoring process creation events and checking for the presence of these unique mutex names.
This rule detects attempts to download Android Application Package (APK) files directly to an endpoint. This activity is often associated with 'quishing' (QR code phishing) attacks, where users are tricked into scanning a malicious QR code that leads to a direct APK download, bypassing official app store security checks. The rule specifically looks for network connection success events where the remote URL or additional fields contain '.apk'.
This rule detects the creation of specific mutex names associated with Claimloader malware activity. The mutex names observed include patterns like 'TB<yearmonthdate>', 'MTM<yearmonthdate>', 'CATM<yearmonthdate>', and fixed strings such as 'GameBoxABC', 'GameGpu0428', 'GameFind057', and 'GameBoxTV59'. Detection relies on monitoring process creation events for these specific mutex names, indicating potential Claimloader execution or presence on a Windows system.
Detects execution of installers from common user download locations with NSIS style command line indicators, consistent with trojanised installer delivery chains.
The rule detects the creation of processes that utilize specific mutex names known to be associated with the Sharp Dragon loader. Specifically, it looks for the mutex name 'mt_app_http_get_zed2vsp'. This indicates potential Sharp Dragon malware execution on a Windows system.
The rule detects the creation of processes that utilize specific mutex names known to be associated with the Leprechaun loader. Specifically, it looks for the mutex name 'LeprechaunHvnc'. This indicates potential execution or activity of the Leprechaun malware loader on a Windows system.
The rule detects the creation of specific mutex names associated with the Fangao loader. It specifically looks for a mutex named 'UniqueMutexName' during process creation events on Windows systems. This activity is indicative of the Fangao loader executing on a system.
Detects known mutexes associated with DUSTTRAP dropper activity. The rule specifically looks for the mutex name 'ICMzUEkdLNayBdWF' during process creation events on Windows systems.
This rule detects the creation of processes that utilize specific mutex names ('Wo0r0KGWhYGO') known to be associated with the CLRLoad loader malware. The detection is based on monitoring process creation events on Windows systems and checking for the presence of these unique mutex names. The primary goal is to identify potential CLRLoad loader activity, which is often linked to initial execution and malware loading.
This rule detects the creation of specific mutexes known to be associated with BunnyLoader malware activity. The rule specifically looks for the mutex name 'BunnyLoader_MUTEXCONTROL'. Detection of this mutex indicates a high probability of BunnyLoader execution on the system.
This query detects evidence of the CrashFix malicious command being stored in the Windows Run dialog (Win+R) history. The RunMRU registry key stores commands executed via the Run dialog. This is a strong indicator that a user was prompted to and did execute the malicious command.
The rule detects the creation of specific mutexes known to be associated with the Tonto Team loader malware. It looks for two distinct mutex names: '{A931568B-94AF-449D-B7F6-6585EF9E9839}' and 'QuitMutex<pid>'. The detection is based on process creation events where these mutex names are observed. This activity is indicative of the Tonto Team loader executing on a system.
This rule detects the creation of specific mutexes associated with the StaryDobry loader. The detection is based on the presence of the mutex name 'com_curruser_mttx'. This activity indicates the potential execution or presence of the StaryDobry malware on a Windows system.
The rule detects the creation of a process that utilizes specific mutex names associated with the Latrodectus loader. Specifically, it looks for the mutex name 'runnung'. This activity is indicative of Latrodectus malware execution.
This rule detects the creation of processes that utilize specific mutex names associated with the GRIMPULL loader. The detection is based on the presence of the mutex name 'aff391c406ebc4c3' during process creation events on Windows systems. The rule aims to identify potential GRIMPULL loader activity by monitoring for these known indicators.
This rule detects the creation of specific mutexes known to be associated with the DarkTortilla loader. The rule specifically looks for the mutex name 'NUkiklN<yjUKNj' during process creation events on Windows systems. The presence of this mutex name indicates potential DarkTortilla malware activity.
Page 18 of 26