Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
Detects evidence of Linux-based cryptomining malware, such as xmrig and associated droppers, along with their persistence mechanisms and efforts to disable system security controls (e.g., SELinux, AppArmor, ufw). The rule monitors process execution, file creation, cron job configuration, and modifications to system immutability locks via chattr.
This rule detects high-frequency file renaming or creation activities within a short timeframe (60 seconds) that involve uncommon file extensions. This behavior is highly characteristic of the encryption phase of ransomware attacks, where malicious processes quickly rename or encrypt files across the system.
Detects the modification or creation of Pluggable Authentication Module (PAM) files or shared libraries in Linux environments. This technique is often used to establish persistence or intercept authentication credentials by replacing legitimate modules like pam_unix.so with malicious counterparts.
This rule detects high-frequency file renaming or creation activities within a short timeframe (60 seconds) that involve uncommon file extensions. This behavior is highly characteristic of the encryption phase of ransomware attacks, where malicious processes quickly rename or encrypt files across the system.
Detects potential payload staging activities within a WSL2 environment where a process writes an executable or script to the Windows filesystem using the DllHost.exe (COM Surrogate) proxy. This rule uses process activity on the host to infer the presence of a WSL2 environment (wsl.exe or vmmem) and analyzes the absence of Windows-native network events, which is a characteristic pattern of WSL2-based network activity being hidden from Windows host telemetry.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the creation of suspicious file types (.exe, .dll, .ps1, etc.) in common staging directories (e.g., C:\Users\Public, C:\Windows\Temp) by the DllHost.exe process. The rule filters out known-good COM surrogate CLSIDs but flags instances where DllHost.exe is launched without a /Processid argument (potential WSL2 proxy activity) or with an unrecognized CLSID, suggesting potential COM hijacking or file staging.
This rule detects the creation of executable or PowerShell script files in common temporary or user-writeable directories by DllHost.exe within 120 seconds of the execution of wsl.exe. This behavior is indicative of potential payload staging where Windows Subsystem for Linux (WSL) might be leveraged to obscure or facilitate the delivery and execution of malicious artifacts.
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
Detects attempts by a Chrome web browser process to create, modify, or rename files associated with sensitive user credentials or application data, such as AWS credentials, browser logins, or environment configuration files. This behavior is indicative of credential theft or staging of sensitive information.
Detects various techniques used by an attacker to escape a container environment or gain unauthorized access to host-level resources. This includes the execution of namespace manipulation tools (nsenter, unshare, chroot), unauthorized access to the docker.sock Unix socket, mounting of host filesystems from within a container, and direct attempts to access the host's /proc/1 namespace files.
Detects behaviors associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the dropping of .sys driver files into non-canonical directories, the registration and execution of kernel services via sc.exe, the use of fltMC to load filter drivers, and the loading of driver modules from non-standard locations.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects indicators of the KuinaExtractor infostealer, including specific named pipes/objects, the creation of a 'zenith_debug.txt' file in user profile directories, and the presence of build-related aliases ('kuina1999', 'k0to') in process command lines or file paths.
Page 105 of 217