Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of node.exe from common user-writable or non-standard directories such as AppData, Downloads, Temp, ProgramData, or Desktop, accompanied by JavaScript file arguments. This behavior is indicative of the TonRAT campaign which uses a portable Node.js runtime to execute malicious JavaScript payloads in a stealthy manner, bypassing standard installation path detection.
Detects execution of SoftEther VPN binaries (vpnclient, vpnserver, vpncmd, vpnbridge) from non-standard directories such as ProgramData, Temp, or AppData. It also identifies masquerading attempts where these binaries are renamed to vmtools.exe or vmwared.exe, and detects execution with specific VPN client/server command line flags outside of the expected installation directory. This rule is designed to identify covert tunneling activities and potential persistence mechanisms used by threat actors.
Detects browser/node subprocesses spawned by AutoGen/Python processes making loopback WebSocket connections to the AutoGen Studio MCP control plane, which is indicative of the AutoJack exploit chain. This rule specifically looks for Python processes associated with 'autogen' or 'autogenstudio' that initiate network connections to loopback addresses on ports 8080 or 8081, often with specific URL paths related to the MCP WebSocket API.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Modular remote access trojan associated with long-term espionage intrusions
Malvertising loader delivering CastleStealer via malicious Google Ads
USB worm and loader leveraging living-off-the-land binaries
Loader used in click-hijacking traffic distribution scheme
Infostealer distributed via fake open-source tool impersonation sites
Photo-themed ZIP phishing campaign dropping a Node.js implant
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lightweight remote access trojan deployed in recruiter-themed social engineering
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Photo-themed ZIP phishing campaign dropping a Node.js implant
Infostealer-as-a-service targeting browser credentials and crypto wallets
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Detects instances where mshta.exe is used to launch suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe, or is associated with HTA files or PteroSand-related indicators. This behavior is indicative of HTML smuggling or malicious HTA-based delivery of secondary payloads.
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Page 302 of 864