Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Photo-themed ZIP phishing campaign dropping a Node.js implant
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer-as-a-service targeting browser credentials and crypto wallets
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Infostealer-as-a-service targeting browser credentials and crypto wallets
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
IoT botnet malware family used for DDoS and proxy infrastructure
Latin American banking trojan using DLL side-loading and overlay attacks
Cloud extortion group exploiting exposed credentials and storage
Latin American banking trojan using DLL side-loading and overlay attacks
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Rust-based ransomware family targeting enterprise environments
Detects an unprivileged process executing from a user-specific temporary directory with the 'RP_' prefix, while simultaneously interacting with specific file patterns in 'C:\Windows\Temp'. This behavior is consistent with the 'RoguePlanet' Time-of-Check to Time-of-Use (TOCTOU) exploit, which uses junction-swap techniques to manipulate Defender quarantine workflow files to achieve privilege escalation.
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
macOS malware used by JINX-0164 against cryptocurrency developers
Page 25 of 43