Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
91 detections
Filters
Last updated
All Time
Detection languages
43
15
9
6
5
Contributors
33
15
13
9
4
Categories
55
22
18
15
14
Platforms
54
20
13
11
5
Products / Services
23
18
11
10
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
Detects anomalous, high-frequency interaction with AI model endpoints characterized by a high volume of requests with a near 1:1 ratio of distinct inputs. This pattern is indicative of automated knowledge-distillation or model extraction attacks against AI services.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects process, named pipe, or mutex events that contain the specific string 'BEAST HERE?', which is often associated with the presence of malicious tools or backdoors using this hardcoded string for identification or synchronization.
This rule detects the creation of specific mutexes known to be associated with malicious software. Mutexes are often used by malware to ensure that only one instance of the malicious process is running on the host at a time, or to signal presence to other components.
Detects the execution or presence of processes associated with the 'dogleash' tool, specifically identifying command lines or file paths that contain architectural references such as 'mips', 'arm', or 'x64', which is indicative of potential cross-platform malware or backdoor deployment.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Loader used in click-hijacking traffic distribution scheme
Campaign converting compromised FortiGate firewalls into credential stealers
macOS malware used by JINX-0164 against cryptocurrency developers
Malvertising loader delivering CastleStealer via malicious Google Ads
Loader used in click-hijacking traffic distribution scheme
Lightweight remote access trojan deployed in recruiter-themed social engineering
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
macOS malware used by JINX-0164 against cryptocurrency developers
Page 1 of 5