Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects adversary activity associated with CL-STA-1062, specifically the use of archive extraction tools to unpack content into hidden or masqueraded ProgramData directories (VMware, Microsoft, Intel). The rule also monitors for process execution and the creation of scheduled tasks that utilize these specific staging paths.
Detects MYRA RAT masquerading as the legitimate 'systemd-userdbd' daemon by identifying processes with that name running outside expected system paths. It also identifies fileless execution patterns where Node.js or npm processes spawn memfd-backed executables, reference deleted files, or initiate processes using the 'systemd-userdbd' name, characteristic of the Miasma campaign.
Loader used in click-hijacking traffic distribution scheme
USB worm and loader leveraging living-off-the-land binaries
Infostealer distributed via fake open-source tool impersonation sites
Detects unauthorized cron job creation or modification associated with cryptominer persistence. The rule monitors for common persistence indicators such as referencing 'lambsys', 'isp.sh', or 'procq' within cron-related commands and shell execution patterns that suggest malicious automated tasks in Linux environments.
Photo-themed ZIP phishing campaign dropping a Node.js implant
Infostealer-as-a-service targeting browser credentials and crypto wallets
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Detects the creation or modification of suspicious LaunchAgent or LaunchDaemon plist files on macOS. Specifically looks for files named 'com.apple.accountsd.plist' or files within a hidden directory '.com.apple.accountsd' in common LaunchAgent/Daemon paths. This pattern is often used by malware for persistence.
Detects attempts to inject attacker-controlled credentials into Entra ID Agent Blueprints via the Microsoft Graph addPassword endpoint. This activity is identified by monitoring Microsoft Graph activity logs for 'addPassword' requests and correlating with Audit Logs for 'Add password' operations targeting resources containing 'blueprint' or 'Blueprint', or where modified properties include 'Blueprint Secret', 'passwordCredential', 'addPassword', or the actor has the 'Agent ID Administrator' role.
Latin American banking trojan using DLL side-loading and overlay attacks
Latin American banking trojan using DLL side-loading and overlay attacks
Campaign converting compromised FortiGate firewalls into credential stealers
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
This rule detects the creation of a scheduled task named 'WindowsVaultSyncService' either through the 'schtasks.exe' command-line utility or via 'ScheduledTaskCreated' device events. This specific task name, combined with a potentially misleading description, could indicate malicious activity attempting to establish persistence or execute code.
Page 74 of 401