Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
57
34
12
2
1
Contributors
34
22
15
12
12
Categories
66
36
14
14
9
Platforms
76
32
10
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
31
19
17
15
15
CVEs
2
2
1
1
1
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Detects the presence of the Montana Empire phishing kit within ZIP archives. The rule identifies specific PHP backend components (mentalite.php, panel_track.php, verify_api.php) often used for credential harvesting, along with unique branding strings and artifacts suggesting AI-assisted development of the phishing kit.
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
IoT botnet malware family used for DDoS and proxy infrastructure
Malvertising loader delivering CastleStealer via malicious Google Ads
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Open-source derived remote access trojan with plugin architecture
Detects coordinated security defense evasion activities by the Lambsys cryptominer campaign. The rule triggers when a shell process (bash, sh, or dash) is used to stop or disable security services (auditd, ClamAV, osquery, Falco, CrowdStrike Falcon), forcibly terminate their processes using pkill or kill -9, and delete or shred critical system security and audit logs (auth.log, syslog, audit).
Detects an Antivirus alert in a highly relevant file path or with a relevant file name.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
IoT botnet malware family used for DDoS and proxy infrastructure
IoT botnet malware family used for DDoS and proxy infrastructure
Credential and browser data stealer distributed via OXLOADER campaigns
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
IoT botnet malware family used for DDoS and proxy infrastructure
Infostealer-as-a-service targeting browser credentials and crypto wallets
IoT botnet malware family used for DDoS and proxy infrastructure
Credential and browser data stealer distributed via OXLOADER campaigns
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Page 2 of 6