Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of .aspx files within common IIS web root directories (inetpub, wwwroot). The rule identifies potential web shell activity by monitoring for specific suspicious filenames (e.g., cmd, shell, upload, file) or by flagging any ASPX creation performed by processes not typically associated with legitimate web application deployments.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects malicious activity associated with the exploitation of StreamBucket PHP vulnerabilities. The rule monitors for unexpected child processes spawned by PHP/web server processes, the creation of specific exploitation artifact files in /tmp, unauthorized reading of /proc/self memory files by PHP, and inbound SOAP-related HTTP requests.
Detects suspicious activities originating from OpenVPN Connect processes, including the spawning of command-line interfaces, scripts, or proxies, as well as the creation of specific ACE marker files and modifications to browser proxy settings, which are indicative of potential exploitation or post-exploitation activity.
Detects Millenium RAT writing captured keystrokes to specific obfuscated file paths or staging files. This behavior includes the creation of keylogger output files within a uniquely named AppData subdirectory (GTR1YB4A7s) or a temporary staging file (C:\debug.txt), which are artifacts used by the RAT before data exfiltration.
Detects the creation of large extensionless files in the C:\ProgramData directory by common archive extractors or script interpreters. This pattern is characteristic of UAC-0226/GIFTEDCROOK payload staging, where malicious loaders or encoded PE artifacts are dropped to disk for subsequent execution or decoding.
Detects the WinRAR.exe process creating a .lnk shortcut file within the user's Startup directory. This behavior is indicative of an exploitation attempt (e.g., UAC-0226 related NTFS path traversal vulnerabilities) where an attacker plants a persistence mechanism via a malicious archive extraction.
Detects the creation of files named 'WC3' or 'wt1' within the 'C:\ProgramData' directory. These filenames are associated with the UAC-0226 threat actor's delivery chain, specifically involving an encoded PowerShell loader (WC3) and an arithmetic-encoded GIFTEDCROOK payload (wt1). These files are typically dropped via path traversal exploitation (CVE-2025-8088) using WinRAR NTFS alternate data streams.
Detects LegionLoader malware activity involving the creation of known-malicious DLLs (7z.dll, normaliz.dll, msvcr90.dll) or the malicious batch script 'xupdate.bat' within non-standard subdirectories of AppData\Roaming. This behavior is indicative of DLL sideloading used to maintain persistence or execute malicious payloads.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects the presence of BeepRAT-related shellcode loader files (config.ini.c or temp.bin) located within a TCC (Tiny C Compiler) directory. These artifacts contain specific shellcode for hash-based API resolution, a technique used to dynamically resolve Windows API functions like LoadLibraryA and GetProcAddress to evade static analysis.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
Detects the execution of known MyBB 'Limited ACP to Admin' proof-of-concept scripts via common python interpreters and identifies suspicious child process spawning behavior from typical web server applications (such as nginx, apache2, and php-fpm). This activity is indicative of post-exploitation attempts or web shell execution via injected plugins or templates.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
Detects potential container escape attempts via 'docker cp' path traversal attacks or suspicious shell execution spawned from the Docker daemon. The rule monitors for directory traversal sequences in 'docker cp' commands, the use of PoC tooling strings, file modifications outside expected container paths, and shell process spawning originating from Docker-related parent processes.
This rule detects the execution of tools associated with HTTP/2 upgrade queue poisoning proof-of-concept (PoC) code or anomalous process-level interactions involving nghttpx. It tracks specific command-line strings, file operations, and unauthorized spawned sub-processes originating from nghttpx, which could indicate attempts to exploit request smuggling vulnerabilities in HTTP/2 implementations.
Detects indicators of the SystemInformer PHSVC (Process Hacker Service) local privilege escalation proof-of-concept. The rule monitors for the loading of the PoC DLL by rundll32, the execution of commands containing specific PoC strings, and the spawning of shell processes by PHSVC-related parent processes.
Detects spearphishing activity involving project-related lure archives, subsequent file drops of potentially malicious DLLs and executables (sideloading indicators), and the execution of processes masquerading as the lure documents.
Detects the creation of multiple archive files (ZIP, 7Z, RAR, TAR) by common utilities (7z, WinRAR, tar) in sensitive temporary directories (Temp, tmp). The rule aggregates activity over a 10-minute window to identify suspicious staging behaviors often associated with ransomware data preparation.
This rule detects the creation of specific temporary directories following a pattern often used by installers or malware, and the subsequent writing of 'wermgr.exe' (Windows Error Reporting manager) into these temporary locations. This behavior is indicative of potential masquerading or process hijacking attempts, where a malicious executable is disguised as a legitimate Windows process by operating from an unexpected, temporary directory.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Page 100 of 217