Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
50
42
24
6
6
Contributors
44
35
20
9
6
Categories
59
44
20
9
7
Platforms
106
14
10
8
5
Products / Services
20
17
12
8
7
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
IDS Classtypes
4
1
1
IDS Protocols
6
Detects the SNOWLIGHT dropper attempting to detect analysis or security tools by rapidly enumerating common debugging, profiling, and analysis executables (such as x64dbg, IDA Pro, Wireshark, Process Hacker, etc.). The rule triggers when a single process queries at least 3 distinct blacklisted tool names more than 5 times within a 1-minute window, a characteristic behavior used to identify and evade analysis environments.
Detects the execution of the Grixba infostealer, which registers a Vectored Exception Handler (VEH) using AddVectoredExceptionHandler. This behavior is used by the malware for execution hijacking and debugger evasion to maintain persistence and prevent analysis. The rule monitors for processes identified as Grixba based on specific naming conventions or execution from suspicious paths like C:\Users\Public\Music\.
Detects the execution of VILE ransomware by identifying specific Go runtime and malware-specific strings in the command line. The detection logic focuses on artifacts related to sandbox and debugger evasion techniques, such as breakpoint trap detection, memory checks, and inspection of the Process Environment Block (PEB) via 'RtlGetCurrentPeb', as well as internal identifiers associated with the VILE ransomware binary.
Loader used in click-hijacking traffic distribution scheme
Infostealer distributed via fake open-source tool impersonation sites
USB worm and loader leveraging living-off-the-land binaries
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
IoT botnet malware family used for DDoS and proxy infrastructure
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Infostealer-as-a-service targeting browser credentials and crypto wallets
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Banking trojan and loader using malicious Office macro delivery
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Clipboard hijacking malware for cryptocurrency address substitution
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Page 5 of 7