Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects WinRAR creating .lnk files within Windows Startup directories under suspicious conditions. The rule looks for indicators of NTFS Alternate Data Stream (ADS) path traversal, where WinRAR might be instructed to write a file into a sensitive directory using a path like 'archive.rar:stream\malicious.lnk'. This behavior is indicative of exploitation attempts related to vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
EXPERIMENTAL: This rule detects RoguePlanet indicators when the Microsoft Defender Antimalware Service Executable (MsMpEng.exe) creates or modifies an executable (.exe, .dll, .sys) file within the System32 or SysWOW64 directories. This behavior can indicate a potential local privilege escalation (LPE) or other malicious activity, especially if Defender is being abused for remediation in a SYSTEM context. The rule specifically highlights 'wermgr.exe' as a high-interest target, but is generalized to catch any PE file.
Detects a multi-stage execution chain involving PowerShell and VBScript, commonly associated with initial access or staging phases of an attack. The rule identifies PowerShell execution with hidden windows, potential malicious downloads from specific domains, script execution via WScript/CScript, and the subsequent execution of dropped files such as 'doc1.exe' from temporary directories.
Detects the use of certutil.exe to decode a base64-encoded file named Link.dat into an executable VBScript payload named Link.ini, specifically within the %USERPROFILE%\Links directory. This behavior is indicative of Kimsuky infection chains where malicious CHM files or MSHTA scripts trigger secondary payloads.
Detects artifacts associated with the SharkLoader malware, specifically the dropping of suspicious .dat and .mui files in AppData staging directories (e.g., xwreg, xgdf) and the subsequent loading of these files as executable modules. This behavior is indicative of MinHook or Detours-based API hooking used for EDR evasion.
Detects the abuse of msiexec.exe to perform suspicious actions such as fetching payloads from remote URLs, UNC paths, or loading from user-writable directories (e.g., AppData, Temp, ProgramData). The rule further correlates this with msiexec spawning suspicious child processes (e.g., cmd.exe, powershell.exe, wscript.exe), which is indicative of malicious post-exploitation activity.
Detects LegionLoader-like behavior where msiexec.exe creates a temporary MSI file in the system temp directory and subsequently executes it using the msiexec command line utility, a pattern often used to proxy malicious payload execution while evading detection.
Detects evidence of the 'smart_window' campaign, which exploits Firefox's SmartWindow feature to exfiltrate private browsing URLs. The rule identifies suspicious outbound network requests to attacker-controlled endpoints containing specific query parameters, the creation of known PoC artifact files, and the spawning of unexpected child processes by the Firefox browser.
This rule detects the creation of Amazon Q Model Context Protocol (MCP) configuration files, identified by 'mcp.json' in specific directories. It additionally correlates this file creation event with concurrent Git operations (checkout, merge, pull, or fetch) performed by a user, flagging the activity as a higher risk signal if both conditions are met.
This rule detects processes running from suspicious temporary directories (e.g., AppData, Windows Temp) that load 'user32.dll' and subsequently create or write to log files in user or application directories. This behavior is highly indicative of keylogging, where malware hooks input functions via user32.dll and stores captured data in local log files for later exfiltration.
Detects the suspicious creation of executable files in C:\ProgramData with randomized paths, typically associated with the SystemBC backdoor. The detection rule correlates this file creation event with co-occurring suspicious activities indicative of ransomware operations, such as the creation of known ransomware-related files (e.g., decryptor notes) or signs of lateral movement via non-standard network traffic and SMB activity.
This rule detects activities related to the 'ipv6_extlen_wrap_probe' proof-of-concept (PoC) exploit, which targets IPv6 extension header vulnerabilities. The detection logic monitors for: 1. Execution of the PoC binary, 2. Compilation of the PoC source code using common compilers like g++ or MinGW, 3. Creation of files associated with the PoC, and 4. Nmap execution with specific flags indicative of an attempt to trigger the vulnerability via raw IPv6 scanning.
This rule detects activities related to the 'Exploitarium' DLX exploit proof-of-concept (PoC) toolkit. It monitors for the invocation of 'objdump' with specific flags used in these exploits, the presence of associated Python and shell scripts on the filesystem, and the spawning of suspicious child processes (like command interpreters or calculators) by 'objdump', which acts as an indicator of successful exploitation or exploit testing.
Detects the presence of the malicious Chrome extension with ID 'flkebkiofojicogddingbdmcmkpbplcd' on an endpoint. This extension is known to hijack the browser's default search provider, redirecting queries to an attacker-controlled domain, and includes manifest configurations that may facilitate future WebAssembly-based malicious execution.
Detects the execution of unauthorized processes or file modifications associated with the 'OpenVPN Connect echo script' vulnerability (ACE). This rule specifically identifies process creation events involving command-line arguments that attempt to trigger script execution on VPN disconnect, even when the software's script permission setting is disabled.
This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.
Detects indicators of 'Bring Your Own Vulnerable Driver' (BYOVD) attacks or suspicious kernel driver installations. The rule monitors for known vulnerable driver files being written to disk, unauthorized creation of .sys files in temporary directories, the installation of new kernel driver services via System Event ID 7045 (referencing temp paths or known malicious drivers), and the use of the sc.exe utility to create services with a kernel driver type.
Detects potential keylogging activity associated with Millenium RAT, characterized by the creation of log files with randomized 8-12 character filenames and folder names within the %APPDATA%\Roaming directory.
Detects the creation of a 'BackupFiles' directory and the subsequent copying of sensitive browser artifacts (e.g., Login Data, Web Data, Local Storage) within Chrome or Edge user data paths. This activity is indicative of credential and session theft staging, specifically associated with the ToddyCat group's Umbrij malware preparation for browser exploitation.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
Detects potential abuse of Active Directory Certificate Services (AD CS) by monitoring for suspicious command-line activity from 'certreq.exe' and 'certutil.exe' associated with certificate enrollment, submission, or management. It also identifies the staging of certificate-related files (.pem, .pfx, .p12, .crt, .cer, .key) in common user directories.
Page 103 of 217