Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
428 detections
Filters
Last updated
All Time
Detection languages
200
76
40
34
29
Contributors
158
92
60
27
16
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
424
3
1
1
Products / Services
180
159
26
18
16
MITRE Techniques
406
338
222
96
94
CVEs
2
USB worm and loader leveraging living-off-the-land binaries
Malvertising loader delivering CastleStealer via malicious Google Ads
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Lightweight remote access trojan deployed in recruiter-themed social engineering
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Cloud extortion group exploiting exposed credentials and storage
Rust-based macOS infostealer implant embedding prompt injection payloads
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Fraud framework powering scam domains for crypto and gambling schemes
Rust-based ransomware family targeting enterprise environments
Rust-based ransomware family targeting enterprise environments
Loader malware delivering follow-on ransomware payloads
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Page 15 of 21