Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Detects instances where the Windows Event Viewer utility (eventvwr.exe) spawns a child process other than the Microsoft Management Console (mmc.exe). This behavior is a well-documented technique for bypassing User Account Control (UAC) because eventvwr.exe is an auto-elevating binary, which can be manipulated to execute arbitrary payloads with high-integrity privileges.
Detects execution of QEMU binaries (e.g., qemu-system-x86_64.exe) that exhibit suspicious characteristics, including command-line references to disk images or databases, execution from user-writable directories (Temp, AppData, etc.), or spawning from unusual parent processes like script interpreters or remote access tools.
Open-source derived remote access trojan with plugin architecture
Detects instances where QEMU-related binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, or ADNotificationManager.exe) load modules from locations other than the standard Windows system directories or the authorized QEMU installation directory. This behavior is indicative of potential DLL side-loading or hijacking attempts, where a malicious DLL is placed in the same directory as the executable to be loaded by the application.
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
Detects the specific pattern of ADNotificationManager.exe loading the vcruntime140_1.dll, which is a known indicator of DLL side-loading used in the Gold Encounter attack chain.
This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.
Detects the execution of QEMU virtualization software by a SYSTEM user account with command-line arguments referencing specific file indicators (e.g., custom.qcow2, vault.db). This behavior is often indicative of an adversary using virtualization to run malicious tools, bypass security controls, or interact with sensitive data in an isolated environment.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
Detects PowerShell invoking ScriptBlock::Create or Invoke-Expression on decrypted in-memory text, which is a technique used by malware like Banana RAT to execute obfuscated or dynamically generated code.
Page 354 of 864