Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or modification of shared object (.so) files within critical Linux PAM library directories (/lib/security/, /lib64/security/, /usr/lib/security/) by processes other than identified system package managers. This behavior is indicative of an adversary replacing legitimate authentication modules with malicious versions to capture credentials or establish persistence, such as the activity documented in Operation Highland (Velvet Ant).
Detects instances where DllHost.exe (COM Surrogate) creates executable or script files in high-risk, user-writable directories. This activity is indicative of potential exploitation of the Windows Subsystem for Linux (WSL2) filesystem proxy, where a Linux process running within WSL2 writes files to the Windows host filesystem (/mnt/c/), resulting in the file creation event being attributed to the DllHost.exe COM surrogate on the Windows side.
Detects the creation of files by WScript.exe or CScript.exe in temporary or program directories followed by the subsequent execution of those files by the same scripting host within a 120-second window. The rule specifically looks for evidence of script-based decoding or processing (e.g., via certutil or hidden windows), which is often associated with the multi-stage execution of payloads.
Detects the creation of executable files with suspicious naming patterns within the C:\ProgramData directory. The rule filters for files with specific file extensions or high-entropy name patterns that do not match common Windows executable file types, potentially indicating staging of malicious payloads.
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
Detects potential PrintNightmare or Print Spooler exploitation by monitoring for the spoolsv.exe service spawning suspicious child processes (e.g., cmd, powershell, rundll32) and unauthorized files being dropped into the printer driver directory.
This rule detects ransomware activity by identifying two primary indicators: a high volume of file renames to common ransomware extensions within a 5-minute window, and the creation of known ransom notes across multiple directories. It excludes processes signed by trusted vendors to minimize noise.
Detects high-frequency file creation, modification, or renaming activity within the user's Desktop directory. This pattern is often associated with ransomware activity, automated data exfiltration tools staging files, or malicious droppers unpacking payloads.
Detects the creation of a file named 'NTDS.zip', which is a common naming convention used by adversaries when compressing the Active Directory database (NTDS.dit) for staging and subsequent exfiltration.
Detects file creation or modification events occurring within directories containing the string 'SysMain_5874288', which may indicate malicious staging of files, persistence, or tool deployment often associated with potentially obfuscated or specific adversary naming patterns.
This rule detects the creation of files with naming conventions associated with common document-based phishing lures (e.g., invoices, fiscal documents) or DNS requests to specific domains (e.g., pages.dev) frequently leveraged by attackers for hosting malicious content.
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
Detects the creation or modification of .vscode/tasks.json files that contain configurations designed to execute tasks automatically upon opening a folder in VS Code, specifically utilizing 'runOn': 'folderOpen' combined with visibility-hiding attributes such as 'reveal': 'never' and 'echo': false. This pattern is commonly associated with supply chain attacks where malicious payloads are hidden within project configuration files.
Detects macOS.Gaslight DPRK-aligned implant registering a LaunchAgent plist using the com.apple.system.services.activity label to masquerade within Apple's com.apple.* namespace for persistence. Key behavioral indicators include file writes to ~/Library/LaunchAgents with the spoofed label and use of __NSGetExecutablePath for binary path resolution.
This rule detects multi-stage attack patterns indicative of Linux privilege escalation or exploit staging. It tracks the creation of known exploit-related files in temporary directories, the compilation of exploit source code, downloading of scripts from GitHub to temporary directories, and the execution of binaries or commands (e.g., 'unshare', 'tc') often associated with kernel-level exploits. It flags hosts where multiple such indicators are detected sequentially within a single session.
Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.
Detects behavior indicative of the Remcos RAT, specifically the use of the Windows Wave API or avicap32.dll for silent audio and webcam recording, followed by the persistence of recorded files in the C:\MicRecords directory.
Detects persistence mechanisms associated with the MYRA Linux RAT, including the use of LD_PRELOAD to load a malicious shared library from a hidden path, persistent shell profile modification via /etc/profile.d/.sh.local, and process masquerading as systemd-userdbd. This rule is linked to the Polymarket Trap campaign involving malicious npm packages.
Detects potential sideloading of malicious Chrome extensions by monitoring for unauthorized file creation of 'manifest.json' files within the browser's extension directories and unauthorized registry modifications related to extension management. The rule specifically excludes legitimate processes like 'chrome.exe' and 'GoogleUpdate.exe', aiming to identify third-party processes attempting to register or install browser extensions.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
Page 112 of 217