Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects high-volume file writes or the use of common command-line copy utilities (xcopy, robocopy, copy) targeting removable drive paths (E-G:). This behavior is often indicative of data staging or exfiltration activities.
This rule monitors for potential abuse of the Microsoft Management Console (mmc.exe) to proxy malicious activity. It detects three primary behaviors: 1) mmc.exe being launched with a .msc file originating from user-writable or suspicious directories; 2) mmc.exe spawning known suspicious child processes (e.g., powershell.exe, cmd.exe, rundll32.exe); and 3) the creation or modification of .msc files in suspicious locations by processes other than mmc.exe or msiexec.exe.
Detects potential dynamic linker hijacking on Linux systems by monitoring for the use of non-standard LD_PRELOAD paths in process command lines or unauthorized modifications to the /etc/ld.so.preload configuration file, which can be used to inject malicious code into processes.
Correlates the ClickFix PowerShell execution with the dropping of the Potemkin loader executable and its associated configuration files into the AppData folder.
Detects the creation of a kernel service pointing to a .sys file located outside the standard Windows system driver directory. This pattern is indicative of a kernel driver being dropped and registered for persistence, a common step in the installation of rootkits or malicious kernel-mode drivers.
This rule monitors for the creation of a new .sys file outside of the standard Windows system driver directories (System32 or SysWOW64) within a 15-minute window of a corresponding registry update to the 'ImagePath' of a service. This sequence is indicative of a persistence mechanism involving the installation of a potentially malicious kernel-mode driver, often used by rootkits or malware to achieve high-privilege execution.
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
Detects the creation or modification of specific file artifacts known to be used by the Remcos Remote Access Trojan (RAT). This includes persistent configurations or log files named 'keylogger.dat' or 'logs.dat' within the user's AppData/Roaming directories, which are characteristic indicators of Remcos activity.
Detects instances where browser processes (msedge.exe, chrome.exe) copy sensitive credential and session SQLite databases (e.g., Login Data, Cookies) to locations outside of the canonical User Data directories. This behavior is indicative of the StegoAd campaign, where malicious browser extensions stage these files for subsequent exfiltration.
Detects the creation or execution of executable files from within %APPDATA%\Local\Temp subdirectories starting with '100000', a path pattern frequently associated with the distribution and staging of infostealer malware such as RedLine and Lumma.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
This rule detects the execution of a process named 'sightgrab.exe' or the creation of suspicious JPG files within the 'C:\Users\Public\Videos\' directory. This activity is indicative of credential or data harvesting tools, often used to capture screenshots or sensitive user data, followed by staging the captured files in public-accessible folders.
Detects suspicious file activity associated with the GIFTEDCROOK (UAC-0226) threat actor. The rule identifies the creation of randomized staging directories under the user profile, the creation of ZIP archives in the user root, and the creation of extensionless files within the Windows TEMP directory.
Detects bulk file access or modifications in sensitive directories (Desktop, Documents, Downloads) targeting credential and document files (ovpn, kdbx, jks, eml, docx, xlsx, pdf), or direct PowerShell access to OpenVPN configuration or KeePass database files. This behavior is indicative of data staging or exfiltration activities associated with the GIFTEDCROOK stealer.
Page 102 of 217