TDL Marketplace

Browse Categories MITRE

Blog LearnMarketAI

Browse Rules

Search and filter across all detection sources

Source

YARA 12,439 Sagan 9,854 Signature Base 5,910 Hayabusa 4,503 Sigma 3,760 Wazuh 2,693 Microsoft Sentinel 2,438 Elastic 2,363 Splunk 2,166 Anvilogic 1,897 Sublime Security 1,331 Elastic Defend 1,324 ReversingLabs 1,240 LOLDrivers 1,195 Panther 1,077 Google Chronicle 922 SEKOIA.IO 756 Bert-Jan Pals 446 mdecrevoisier 337 MITRE CAR 102 Falco 95 FalconForce 59 SEKOIA.IO Rules 30 Synacktiv 16 Rapid7 Labs 6

Platform

Windows 39,504 Linux 29,696 macOS 2,323 Cloud 9,187 Container 268 Network 2,726

Severity

critical 2,567 high 12,362 medium 10,639 low 4,276 informational 2,945

MITRE Tactic

Initial Access 1,680 Execution 4,653 Persistence 3,761 Privilege Escalation 3,726 Defense Evasion 5,758 Credential Access 2,094 Discovery 1,570 Lateral Movement 1,004 Collection 827 Exfiltration 738 Command & Control 1,895 Impact 1,056 Resource Development 140 Reconnaissance 195 Defense Impairment 1,149

Language

sigma 9,852 spl 3,683 kql 4,098 eql 2,543 yara 20,345 yara-l 922 python 1,077 mql 1,331 xml 2,693 sql other 10,415

17 rules

yara unknown yara

IsConsole [packers]

yara unknown yara

IsDLL [packers]

yara unknown yara

IsPE32 [packers]

yara unknown yara

IsPE64 [packers]

yara unknown yara

IsWindowsGUI [packers]

yara unknown yara

IsNET_DLL [packers]

yara unknown yara

IsNET_EXE [packers]

yara unknown yara

ExportTableIsBad [packers]

ExportTable Check

yara unknown yara

HasDebugData [packers]

DebugData Check

yara unknown yara

HasDigitalSignature [packers]

DigitalSignature Check

yara unknown yara

HasOverlay [packers]

Overlay Check

yara unknown yara

HasTaggantSignature [packers]

TaggantSignature Check

yara unknown yara

ImportTableIsBad [packers]

ImportTable Check

yara unknown yara

IsPacked [packers]

Entropy Check

yara unknown yara

HasRichSignature [packers]

Rich Signature Check

yara unknown yara

IsBeyondImageSize [packers]

Data Beyond ImageSize Check

yara unknown yara

HasModified_DOS_Message [packers]

DOS Message Check

© 2026 Threat Detection Labs — 55,000+ open-source detection rules