Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,304 detections
Filters
Last updated
All Time
Detection languages
676
264
155
72
49
Contributors
232
195
187
166
110
Categories
344
308
229
217
143
Platforms
472
418
224
173
138
Products / Services
264
262
195
176
104
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,304
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
Yara rule that detects ProjectHookPOS infostealer.
Page 63 of 63