Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects processes launched from common user-writable or temporary directories (Downloads, AppData/Temp, etc.) that initiate a network connection more than 60 seconds after the process start time. This behavior is indicative of a delayed C2 beaconing or a dormant malicious payload being activated.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects Jellyfin's automatic library scan invoking ffprobe with the characteristic command-line fingerprint associated with CVE-2026-8461 exploitation. The MagicYUV heap OOB write fires during metadata extraction of crafted AVI/MKV/MOV files, potentially achieving RCE as the jellyfin service user (uid=115).
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Loader used in click-hijacking traffic distribution scheme
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Page 42 of 60