Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
This rule detects the creation of directories or files within the '\Temp\' directory that match a specific naming pattern ('RP_' followed by an alphanumeric string). This pattern is often associated with the creation of temporary artifacts by scripts, installers, or malicious payloads.
This rule detects the creation of NTFS reparse points or junctions within temporary directory paths, often used by adversaries to bypass directory access controls or redirect file system operations. The rule identifies file creation activities occurring under paths matching a specific temporary folder pattern (RP_ followed by a hex string) and excludes legitimate system operations like wermgr.exe executions.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects high-frequency file creation or modification events within directories matching the 'RP_<UUID>' naming pattern in Windows temporary folders. This behavior is indicative of Poseidon generator/worker threads attempting to cause I/O saturation to exploit Time-of-Check Time-of-Use (TOCTOU) vulnerabilities in security products like Microsoft Defender (MsMpEng.exe).
Detects the execution of a PyInstaller-compiled payload associated with the Yuta/Glove Stealer campaign. The rule monitors for processes launching from temporary _MEI* extraction directories within %APPDATA% or %TEMP%, and specifically identifies the winupdate.exe payload within .cache subdirectories.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
This rule detects the use of Rclone for cloud file synchronization or configuration file creation on endpoints that have shown recent activity related to QEMU virtualization. The detection correlates process execution or file creation events involving Rclone with prior QEMU execution within a 24-hour window, which may indicate an adversary using virtualization to stage or exfiltrate data.
This rule detects potential ransomware activity by monitoring for QEMU virtualization software spawning child processes followed by mass file encryption (using extensions .threeamtime or .bqtlock) and the creation of typical ransomware note files (e.g., RECOVER.txt, README.txt).
Commodity .NET keylogger and remote access trojan
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
Detects BQTLock ransomware activity by monitoring for mass file encryption events (file extensions .bqtlock or .baqiyatlock) and the creation of associated ransom note files (README.bqtlock or HOW_TO_DECRYPT.txt) using Sysmon and Windows Security Event logs.
Detects the use of the native Windows curl.exe utility to download a .zip file from an external URL, followed by the creation of that file on the disk. This pattern is associated with the Potemkin Loader which uses this technique to fetch RMM components, effectively bypassing PowerShell-based detection mechanisms for file downloads.
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
Detects unauthorized attempts to access or dump credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors for execution of known credential-dumping tools (e.g., secretsdump), cross-process access to lsass.exe, suspicious process command-line arguments (e.g., comsvcs, MiniDump), and the creation of files indicative of credential theft (e.g., lsass.dmp, wceaux.dll).
Detects the creation or modification of specific malicious macOS LaunchAgent plist files (com.nvm.protocal.plist) or payload files (protocal.cjs) within the NodePackages directory, indicative of the easy-day-js backdoor establishing persistence.
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
Page 119 of 217