Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects a two-stage DLL sideloading chain associated with Mustang Panda campaigns, specifically utilizing the SHARDLOADER and ZOHOMURK malware components. It monitors for the loading of malicious DLLs ('SolidPDFCreator.dll', 'ctxmui.dll') by specific binaries, as well as the execution of associated staging processes and file creation events in public directories.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
Detects the installation of the NexShield malicious Chrome extension, which impersonates uBlock Origin Lite. The rule monitors for the creation or modification of 'manifest.json' files within Chrome extension directories and registry key activity related to the extension's installation, specifically flagging references to 'NexShield' or deceptive 'uBlock Origin Lite' naming conventions.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
This rule detects potentially malicious behavior associated with web browser processes, including the execution of Python scripts, the loading of browser extensions from non-standard directories like AppData or Temp, the creation of Python scripts by browsers in temp folders, and outbound network connections by Python processes following browser activity. These patterns are often associated with browser-based exploitation, extension-based malware, or initial access stages where a browser is used as a conduit for malicious code execution.
This rule detects potential exploitation of CVE-2025-8088 involving WinRAR or unrar processing malicious archives with path traversal characters (../ or ..\). It identifies the extraction of script files (HTA, VBS, PS1, BAT) into the Windows Startup folder, followed by the execution of these files via mshta.exe or wscript.exe within a 30-second window, characteristic of Gamaredon group persistence mechanisms.
Detects a multi-stage attack sequence where a web-facing application (e.g., Python, Node.js) downloads a file to a temporary directory (/tmp or /var/tmp) using curl or wget, creates the file, and subsequently applies executable permissions (chmod +x) to it. This pattern is characteristic of CVE-2026-33017 exploitation targeting Langflow to deploy cryptomining binaries.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects the configuration and usage of personal Microsoft OneDrive accounts on corporate endpoints. This is achieved by monitoring for OneDrive process execution with personal account command-line arguments, OneDrive setup utilities configured with personal tenant identifiers, and file system activity within directory paths associated with personal OneDrive synchronization.
Detects potential exploitation of ProxyLogon (CVE-2021-26855) on Microsoft Exchange Servers. The rule identifies suspicious process activity where IIS worker processes (w3wp.exe) or Exchange UM processes (UMWorkerProcess.exe) spawn command-line shells (cmd.exe, powershell.exe, etc.) or create web shell files within Exchange-specific web directories (e.g., OWA, autodiscover, ecp).
Detects the execution of VILE ransomware by correlating the launch of the binary with the creation of specific artifacts used for system information discovery, specifically timezone-based geofencing and anti-analysis configurations.
Detects the creation of specific file artifacts associated with the VILE ransomware. The VILE ransomware Go-based binary is known for employing ETW tracing suppression and direct NT system calls to bypass EDR user-mode hooking. Identifying these unique filenames on the host acts as a high-fidelity indicator that the VILE binary is actively present and executing.
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Detects the loading of known vulnerable drivers (rwdrv.sys, hlpdrv.sys) used for potential Bring Your Own Vulnerable Driver (BYOVD) attacks, accompanied by evidence of antivirus tampering through process execution or the creation of suspicious directories related to AV killing utilities.
This rule monitors system activity for the presence of specific file names, paths, and image loads associated with known malware families, specifically BlueHammer, RedSun, UnDefend, Bluekit, and libpwn. The rule evaluates process creation, file creation, and DLL load events across EDR and endpoint logs to identify potentially malicious indicators.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Detects the creation or modification of specific suspicious .pyd files (Python extension modules) within temporary directory paths, excluding legitimate processes or publishers associated with Python Software Foundation or Microsoft Corporation. This behavior is indicative of potential side-loading or persistence mechanisms involving malicious Python extensions.
Page 108 of 217