Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects endpoint file creation or modification events involving PDF files with suspicious, lure-like filenames (e.g., 'Settlement Agreement') being written by email clients or web browsers. This rule acts as a proxy for identifying potential spearphishing attachment execution on the endpoint.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects file creation, writing, or opening events related to a known malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd). This specific ID is often associated with malicious browser extensions used for credential theft, unauthorized data exfiltration, or establishing persistence.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
Detects the creation or modification of an mcp.json file within IDE configuration directories (.vscode, .amazonq), followed shortly by the execution of shell or interpreter processes (bash, sh, cmd, powershell, npx) by the IDE process. This behavior suggests the installation of a malicious Model Context Protocol (MCP) server configuration that could facilitate command execution or persistence within the developer environment.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
Detects the transfer of executable or script files to remote administrative shares (ADMIN$, C$, IPC$) between hosts, a behavior frequently observed in SystemBC staging operations and lateral movement activities associated with ransomware actors.
This rule detects persistence mechanisms associated with BeepRAT (a DcRAT variant) by correlating the creation of suspicious files (DLL, EXE, or C files) in user-writable directories (e.g., AppData, Temp, ProgramData) with the subsequent execution of 'schtasks.exe /create'. It specifically monitors for task creation commands referencing these suspicious paths, known loader binaries (rundll32, regsvr32, tcc.exe), or specific naming conventions like 'WindowsUpdateTempFileCleanUp'.
This rule detects potential DLL side-loading and file staging activity by monitoring for the execution of specific suspicious binaries or the loading of known malicious DLLs from non-standard or staging directories like C:\Users\Public\Documents\ or C:\ProgramData\IDM\logs\. The rule flags activity associated with loaders like SHARDLOADER, ZOHOMURK, and MINIRECON.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
This rule detects potential web shell activity on Windows IIS servers by monitoring for suspicious process creation and file write events originating from the w3wp.exe worker process. Specifically, it flags when w3wp.exe spawns command shells (cmd, powershell), database management utilities (sqlcmd, osql), or network discovery/transfer tools (curl, wget, certutil, bitsadmin). It also detects the creation or modification of common web shell file extensions (.aspx, .ashx, .asmx) within web root directories.
Detects components of the StrikeShark campaign, specifically the staging of SharkLoader payloads within specific AppData subdirectories (%APPDATA%\xwreg or %APPDATA%\xgdf) and the sideloading of a rogue SystemSettings.dll by the legitimate SystemSettings.exe process from an unauthorized location.
Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.
Detects the loading of known hooking libraries (MinHook or Microsoft Detours) or SharkLoader-specific components (SyncRes.dat) into non-system processes, followed by the staging of payload components in user directories. This behavior is indicative of malware attempting to intercept critical system APIs (such as VirtualAlloc and Sleep) to evade memory scanning and analysis by EDR solutions.
Detects anomalous behavior associated with the TrymeLocker watchdog loop, characterized by high-frequency registry modifications to Windows Policy restriction keys paired with rapid mass creation of executable files in common system directories within a short window.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects processes running at High or System integrity levels that correlate with the creation of specific file artifacts known to be associated with VILE ransomware. The rule monitors for potential privilege escalation or token manipulation indicative of the ransomware's attempt to gain necessary permissions for encryption operations.
Detects behavior consistent with the Pay2Key ransomware, which checks for the presence of Avast security software directories, verifies SYSTEM account access via registry queries, and performs subsequent DLL sideloading by dropping 'powrprof.dll' into the Avast application folder.
Page 114 of 217