Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
macOS malware used by JINX-0164 against cryptocurrency developers
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
This rule detects the 'Bring Your Own Vulnerable Driver' (BYOVD) technique by monitoring for the creation of new kernel-mode drivers in temporary locations (followed by an immediate registration as a service) that correlate with known vulnerable drivers. It checks file system events for driver drops and links them to service installation events (EventCode 7045) within a 5-minute window.
Detects rapid deletion and recreation of cloud storage buckets (S3 or Azure Storage) within a short timeframe (60 seconds). This behavior is often indicative of an attempt to hijack a bucket name or gain unauthorized access to data by exploiting race conditions or misconfigurations in infrastructure management.
Detects anomalous behaviors associated with malicious npm package self-upgrades, where node.exe modifies its own source files within node_modules or spawns npm pack commands to replace existing dependencies with malicious versions.
Detects indicators of the BUMSRAKETE FreeBSD kernel-level exploit (CVE-2026-45257). This rule monitors for exploit artifact file creation, malicious use of dd to overwrite SUID binaries for privilege escalation, kernel configuration enumeration via sysctl, spawning of shell processes with root UID from suid-related binaries, and kernel version fingerprinting.
Detects evidence of exploitation for CVE-2026-45257, a FreeBSD vulnerability that allows bypassing chflags schg immutable flags. The detection tracks the initial reconnaissance phase where unprivileged processes query the sysctl 'kern.ipc.mb_use_ext_pgs' followed by the creation of specific exploit restorer artifacts '/tmp/.lpe_orig' and '/tmp/.x'.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
Detects indicators of persistence via dynamic linker hijacking on Linux systems, specifically looking for the creation or usage of .libcache.so, modifications to /etc/ld.so.preload, hidden shell profile droppers, or node process execution utilizing LD_PRELOAD variables.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects potentially suspicious process creation or file modification activities associated with Autodesk applications or generic 'appcompat' paths. The detection logic flags processes executing with the '-uiDll' command-line argument and specific file operations (Creation/Modification) involving configuration or log files, often associated with unauthorized software tampering or suspicious binary execution patterns.
Detects activity associated with the SPECTRALVIPER malware loader, specifically identifying known malicious file hashes (system.config.xml, NotificationConfig.json) and cross-process memory injection patterns (RemoteMemoryAllocation, RemoteMemoryWrite, CreateRemoteThreadApiCall) initiated by specific suspect processes.
Detects the exploitation of the CVE-2025-8088 vulnerability in WinRAR, where a path traversal technique is used to extract malicious files directly into the Windows Startup folder. This pattern is associated with threat actors like Gamaredon to achieve persistence, typically by placing HTA downloaders that execute upon user logon.
Detects instances where DllHost.exe creates or writes executable, script, or library files into common user-writable directories (e.g., C:\Users\*, C:\ProgramData\*, C:\Temp\*). This behavior is often associated with file staging or the delivery of malicious payloads. The rule also checks if the DllHost.exe process was spawned by WSL (Windows Subsystem for Linux) related processes, which can be indicative of cross-environment execution or evasion techniques.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Detects file creation or renaming events associated with JFMBackdoor, including unauthorized file manipulation in common system locations and the presence of known backdoor component filenames. It also monitors for suspicious file attribute manipulation performed by processes running from temporary directories.
Detects a suspicious sequence of events where a file with an architecture-specific name (often associated with botnet payloads like JDY/KV-botnet) is created, executed, and deleted within a 60-second window. This behavior is indicative of transient malicious payloads executing and self-removing to evade detection.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Page 101 of 217