Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects WinRAR creating a malicious VBS/VBE script within the Windows Startup folder using NTFS Alternate Data Streams, a behavior associated with the exploitation of CVE-2025-8088 by the Gamaredon threat group.
Detects anomalous activity associated with the RoguePlanet (CVE-2026-50656) exploit. The rule identifies suspicious file operations by MsMpEng.exe within temporary staging directories (RP_<UUID>), execution of non-Microsoft signed binaries from these staging paths, and unexpected file activity involving 'wdtest_temp' paths, which are indicative of an NTFS junction swap exploit sequence.
Detects the creation of specific file and directory structures under the %TEMP% directory associated with the RoguePlanet (CVE-2026-50656) exploit. The exploit utilizes a UUID-named directory prefixed with 'RP_' to stage components, including wermgr.exe and wdtest_temp, required for a junction swap attack against Microsoft Defender. The detection excludes known system processes that might access the temporary folder.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
Detects the Yuta/Solara .NET WPF dropper (SLaunch.exe) executing the staging phase of a PyInstaller-compiled Python stealer (winupdate.exe) into the %APPDATA%\.cache directory, as observed in the Glove Stealer campaign.
Detects the execution of QEMU processes, the presence of suspicious virtual disk files (e.g., .qcow2, .db) in unexpected locations, and the installation of Virtio drivers. These patterns may indicate an adversary is deploying hidden virtual machines to bypass host-based security controls.
Detects potential surveillance activity by monitoring for screenshot image files written to suspicious directories (such as Temp or AppData) by non-whitelisted processes, and identifies unauthorized access to camera or video capture devices by processes that are not standard conferencing or imaging software. This rule is designed to detect capabilities often associated with Remote Access Trojans (RATs) such as AtlasRAT and ValleyRAT.
Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.
This rule detects potential keylogging activity by identifying either low-level Windows keyboard hooks initiated by suspicious processes or the creation of suspicious log files in user-writable directories by unsigned processes. It filters out common, trusted browser processes and signed Microsoft binaries to reduce noise.
Detects the repeated creation of text or log files in common temporary staging directories (TEMP, APPDATA) by non-standard processes. This behavior is indicative of malware, such as Atlas RAT or Gh0stRAT, periodically flushing captured keystrokes to a file before staging for exfiltration.
Clipboard hijacking malware for cryptocurrency address substitution
This rule detects the execution of common archival utilities (7-Zip, WinRAR, RAR, ZIP) with parameters indicative of password-protected archive creation. It specifically flags instances where a user account, with no recorded prior history of running these utilities in the last 30 days, creates a large archive (exceeding 1GB) spanning multiple directories. This pattern is commonly used for data staging and preparation prior to exfiltration.
Detects the creation of files with extensions commonly associated with web shells (.php, .aspx, .jsp) within typical web application directories by common web server processes such as httpd, nginx, php-cgi, and w3wp. This activity is indicative of a potential web shell deployment for persistent access or command execution.
Detects suspicious bulk archiving activity or file drops of archive formats in staging directories. The rule monitors for common archival utilities (7zip, WinRAR) or PowerShell's Compress-Archive command being used, or the creation of archive files in suspicious paths (e.g., Temp, AppData, Public). It alerts when high volumes of archives are created, password-protected archives are used, or rapid archival operations are performed.
Detects the loading of an eBPF rootkit by Node.js or NPM processes. This rule monitors for file creation events within the /sys/fs/bpf/ directory triggered by these processes, which is a known behavior of the IronWorm infostealer attempting to hide processes and network connections.
This rule detects various stages of exploitation associated with the CVE-2026-45257 'BUMSRAKETE' vulnerability, which targets FreeBSD kernels. It monitors for the execution of exploit binaries, compilation of source code related to the exploit, the presence of specific staging files in temporary directories, and the subsequent spawning of shells by the exploit process. It also identifies command-line arguments indicative of BUMSRAKETE activity.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects the creation of executable files (.exe or .dll) on a removable drive followed by the execution of a process from that same drive within a 30-second window. This behavior is indicative of an adversary using removable media to stage and execute malicious payloads.
Detects execution of the BUMSRAKETE exploit targeting the CVE-2026-45257 FreeBSD kTLS-RX page-cache corruption vulnerability. The rule identifies the exploit binary launching from a non-privileged context alongside the creation of staging files used to corrupt system binaries and escalate privileges to root.
Detects execution and post-exploitation behaviors associated with the BUMSRAKETE exploit, specifically targeting page-cache overwrite privilege escalation (CVE-2026-45257). The rule identifies the presence of malicious binaries, staging artifacts in /tmp, and unprivileged processes spawning shells via SUID binaries (su, passwd) that indicate successful exploitation.
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Page 104 of 217