Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects when five or more driver-related files (.inf, .sys, or .drv) are created or modified within a one-hour window by the same initiating process account. This behavior can be indicative of malicious driver installation, rootkit activity, or other forms of persistence or privilege escalation.
Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.
Detects potential screen capture activity by the Remcos RAT by monitoring for image file creation in the AppData\Roaming\Screenshots directory with specific naming patterns ('time_' or 'wnd_'). The rule scopes this to processes executing from suspicious paths such as AppData or ProgramData, while filtering known legitimate screen capture software.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
Detects the creation or modification of a file named 'help.php' within directories associated with REDCap deployments. This activity is a known persistence mechanism used by threat actors like UNC6508 to establish web shell access.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Detects the Potemkin Loader using the native Windows curl.exe utility to download a ZIP archive from a remote source, followed by the creation of a local .zip file. This behavior is used to bypass security controls by avoiding PowerShell-based download mechanisms.
Detects persistence attempts by the Amadey infostealer. The rule monitors for unauthorized creation of .job files directly in the Windows Tasks directory or the execution of schtasks.exe from suspicious locations such as TEMP or APPDATA folders.
Detects indicators associated with the deployment and execution of NetSupport RAT, including the launch of 'client32.exe', loading of the 'pcicl32.dll' module, outbound network connections, and the creation of the 'client.ini' configuration file. It also flags execution chains where 'client32.exe' is spawned by common browser or living-off-the-land processes.
Detects evidence of credential dumping activities, including the execution of known Mimikatz-related binaries or command lines, unauthorized memory dumping of the LSASS process using tools like procdump or rundll32 with comsvcs.dll, and the presence of known credential dumping artifacts on disk. It also monitors cross-process access to lsass.exe by potentially unauthorized or unsigned processes.
Detects potential timestomping activities via PowerShell APIs or touch.exe usage, alongside the creation or modification of known webshell filenames in web directories or files placed in common web root subdirectories by web server processes.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects indicators of Akira ransomware activity, specifically the deletion of Volume Shadow Copies using vssadmin, the creation of known Akira ransom notes (akira_readme.txt, restore_files.txt), and the generation of files with the .akira extension.
This rule detects the creation or modification of .aspx or .php files within a 'wwwroot/images' directory, specifically where the time difference between consecutive creation events for the same file path exceeds 24 hours (86400 seconds). This behavior is often associated with the placement of web shells or backdoors in web server directories, where adversaries attempt to masquerade malicious scripts as image files.
Detects Akira ransomware-related activity by identifying the creation of characteristic ransom notes or files with the .akira extension, combined with signs of security defense impairment (such as disabling Windows Defender via command line).
Detects the creation of ASPX files in sensitive SharePoint directories (masterpage, layouts) by the w3wp.exe process, which is indicative of web shell deployment. Additionally, this rule identifies instances where w3wp.exe spawns shell processes like cmd.exe or powershell.exe, suggesting potential command execution via a compromised web server.
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
Detects Millenium RAT (or similar malware associated with the Y2K Operators campaign) writing keystroke capture files to user APPDATA directories. The rule specifically monitors file creation events by non-browser/non-UI processes that utilize suspicious file extensions (.g0, .txt, .log, .dat).
This rule detects the creation of files with specific suspicious names or within a specific suspicious directory path under the user's AppData Roaming folder, which is commonly used for persistence by malware or unauthorized tools.
Detects the creation of persistence via a malicious Windows service named 'MixedSvc' or any service pointing to 'Mixed Reality.exe' located within 'C:\Program Files\Windows Media Player\'. This activity is consistent with the 'Operation DragonReturn' campaign and the 'Silver Fox' threat actor, where the 'Mixed Reality.exe' binary acts as a host for DLL-sideloading of the DcRAT backdoor.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Page 113 of 217