Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
57
34
12
2
1
Contributors
34
22
15
12
12
Categories
66
36
14
14
9
Platforms
76
32
10
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
MITRE Techniques
31
19
17
15
15
CVEs
2
2
1
1
1
Detects the embedded configuration structure within unpacked DLL samples associated with the Sauron loader, specifically targeting a fixed magic constant (0xbaadf00d) followed by a 0x40 flag byte.
Detects the presence of known AnonyMousKIT Phishing-as-a-Service (PhaaS) shared components (legacy.js, Core.js, ToolsController.php) by matching specific file hashes or detecting these filenames in small files. This rule is designed to identify backend infrastructure used by phishing resellers.
Detects the presence of the i-Realm companion tool associated with the AnonyMousKIT PhaaS platform, which is designed to bypass iOS Activation Lock features.
Detects the presence of the i-Realm companion tool associated with the AnonyMousKIT PhaaS platform, which is designed to bypass iOS Activation Lock features.
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
This rule identifies potential SparroWocky malware payload files by detecting a specific custom header (0x11328712 in both little-endian and big-endian format) used for identifying encrypted .dat files that contain embedded RC4 keys.
Matches known Phantom Stealer MaaS infostealer sample hashes
Matches known Phantom Stealer MaaS infostealer sample hashes
Matches known Phantom Stealer MaaS infostealer sample hashes
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Detects known Koktevrat Android RAT campaign APK artifacts by published SHA-256 hashes and associated package name string
Matches known Phantom Stealer MaaS infostealer sample hashes
Detects known KATARU IoT malware binaries via embedded strings and known SHA-256 hashes
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known RedTail malware payloads and staging scripts by exact SHA-256 hash equality
Matches known Larva-24009 (HeptaX) malicious file hashes
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
IoT botnet malware family used for DDoS and proxy infrastructure
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Page 1 of 6