Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the silent extraction of ZIP archives using the native Windows tar.exe utility into application data directories. This behavior is indicative of the Potemkin Loader, where attackers stage malicious payloads following an initial download to evade detection.
Identifies Node.js process decrypting embedded payload via custom XOR algorithm.
Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Infostealer distributed via fake open-source tool impersonation sites
Malvertising loader delivering CastleStealer via malicious Google Ads
Infostealer distributed via fake open-source tool impersonation sites
USB worm and loader leveraging living-off-the-land binaries
Loader used in click-hijacking traffic distribution scheme
Modular remote access trojan associated with long-term espionage intrusions
Malvertising loader delivering CastleStealer via malicious Google Ads
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Infostealer-as-a-service targeting browser credentials and crypto wallets
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Lightweight remote access trojan deployed in recruiter-themed social engineering
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Rust-based macOS infostealer implant embedding prompt injection payloads
Page 45 of 81