Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,161 detections
Filters
Last updated
All Time
Detection languages
517
470
72
54
20
Contributors
259
229
161
156
125
Categories
20,438
11,829
5,872
5,150
4,864
1,161
Platforms
1,140
28
18
1
Products / Services
427
403
35
18
15
MITRE Techniques
812
471
460
439
429
CVEs
6
6
5
5
3
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects potential DLL sideloading where the legitimate Avira antivirus binary (avscan.exe) loads a custom DLL (avscan.dll) from user-writable directories such as AppData, Public, or ProgramData, potentially accompanied by a configuration file.
Detects DeElevate64.exe within the Stardock Smart DeElevation Tool directory loading I++u.dll, a known malicious loader dependency associated with patched DeElevator64.dll usage.
Detects the execution of fsquirt.exe spawned by INISAFECrossWebEXSvc.exe where fsquirt.exe subsequently loads an unsigned or untrusted DLL, indicative of a potential TechHub DLL side-loading technique.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects potential local privilege escalation (LPE) attempts leveraging the afd.sys vulnerability by correlating LPEClient or FudModule artifact creation, image loads, or process execution with subsequent afd.sys driver loading or exploit guard blocking events within a 60-minute window.
Detects potential DLL sideloading of mscoree.dll outside of standard system and .NET paths, followed closely by network activity connecting to GitHub from the same process within a one-hour window.
Detects the writing and subsequent loading of driver files signed by a specific certificate holder (Wenjiang District Mingyu Network Technology), utilizing DeviceFileCertificateInfo, DeviceFileEvents, and DeviceImageLoadEvents.
Detects googleupdate.exe loading an unsigned DLL from a non-standard path, followed by network communication to a known Command and Control (C2) domain or IP address.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects the correlation between the loading of known stealer plugin DLLs outside of standard application paths and subsequent process activity accessing credential stores, sensitive files, or executing wireless key recovery commands.
Correlates a Webcam.dll image load with VM-detection commands (such as queries for VirtualBox, VMware, vbox, vmtoolsd, Win32_ComputerSystem, or Win32_BIOS) executed by the same RegSvcs.exe process, which is characteristic of XWorm malware behavior.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects when a Bandizip executable loads an unsigned dynamic-link library (DLL) from outside the standard installation directory, where the Bandizip process was launched by explorer.exe, potentially indicating DLL side-loading.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Detects known Indicators of Compromise (IOCs) associated with the Ebury Linux backdoor, including specific file hashes, implants like libkeyutils.so.1.10.2, malicious IP connections, and associated network/email artifacts using Microsoft Defender XDR advanced hunting.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects the presence of known MD5 file hashes associated with the TraderTraitor trojanized Terraform provider campaign (also known as FLATROOF/ROOFDECK). The query sweeps DeviceFileEvents, DeviceProcessEvents, and DeviceImageLoadEvents across the last 30 days.
Page 1 of 56