Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects suspicious activity on Oracle database hosts, including the spawning of unexpected child processes from Oracle service binaries (such as cmd.exe or shells), the creation or access of known exploit-related script filenames, and the use of UTL_FILE to write files with suspicious extensions to temporary directories, which are patterns indicative of exploitation attempts like DBMS_SCHEDULER remote code execution or data exfiltration.
Detects evidence of the MYRA RAT attempting to establish persistence via the LD_PRELOAD environment variable. This is achieved by creating or modifying malicious shared libraries (e.g., .libcache.so) and configuring system startup files (e.g., /etc/profile.d/.sh.local) to ensure the library is loaded by the dynamic linker on startup.
Detects instances where a Node.js process accesses, modifies, or creates files within web browser extension directories. This behavior is indicative of unauthorized access to sensitive browser data, such as extension configurations, authentication tokens, or stored secrets.
Detects potential keystroke logging activity using Python scripts. It monitors for Python processes invoking keylogging libraries or APIs, modification of power settings to prevent system sleep (a common tactic to maintain logger persistence), and the creation of text or log files in common user-writable directories.
Detects the creation of executable files (.exe or .dll) on a removable drive followed by the execution of a process from that same drive within a 30-second window. This behavior is indicative of an adversary using removable media to stage and execute malicious payloads.
Detects the staging of exploit artifacts and subsequent spawning of a shell from a modified SUID binary, indicating the exploitation of CVE-2026-45257 (BUMSRAKETE) to achieve root privilege escalation via page-cache shellcode injection.
Detects indicators of the BUMSRAKETE exploit, specifically looking for malicious binary names, staging files, and a high-frequency loop pattern involving SUID binaries (su, passwd) by unprivileged users. This pattern is consistent with a kTLS page-cache corruption exploit targeting CVE-2026-45257.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
This rule detects a suspicious pattern involving two events occurring on the same host: the creation of a DLL file with a 'meow_' prefix (potentially associated with known malware patterns) and the execution of a command-line interpreter (cmd.exe, powershell.exe, or pwsh.exe) as a child process of suspicious parent processes like svchost.exe, services.exe, dllhost.exe, or msiexec.exe.
Detects the execution of Python processes with command-line arguments indicative of keylogging activity (e.g., pynput, keyboard, keylog) or Python processes creating/writing to files with names suggesting keylogging behavior (e.g., log.txt, keylog). This rule targets potential data collection via keyboard interception by monitoring process creation and file write events.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Detects MSBuild project files created beneath C:\ProgramData, an uncommon location that has been abused by threat actors to stage malicious project files for code execution.
This rule detects a single process creating a large number of files with diverse file types within a short time frame (5 minutes). This behavior can be indicative of malicious activity such as ransomware encrypting files, data staging for exfiltration, or malware dropping multiple components.
This rule detects the creation or modification of executable files (.exe, .dll, .sys) within critical Windows system directories (C:\Windows\System32\ or C:\Windows\SysWOW64\). Such activity can indicate an attempt to establish persistence, elevate privileges, or inject malicious code into legitimate system processes.
This rule detects the creation or modification of executable files (.exe or .dll) on hidden Windows administrative shares (e.g., ADMIN$, C$, D$, IPC$), followed by the execution of a process with the same file hash on a different host within a one-hour window. This behavior is indicative of lateral movement using SMB shares to stage and execute malicious payloads.
Detects file modification or creation events affecting critical authentication components, specifically Pluggable Authentication Modules (pam_unix.so) and OpenSSH binaries (sshd, ssh, scp). Such activity is highly indicative of an attempt to backdoor the authentication process to facilitate unauthorized access or credential theft, as observed in Operation Highland.
Detects the modification or creation of shared object files (.so) within common Linux Pluggable Authentication Modules (PAM) directories. Adversaries often modify these modules to establish persistence, capture credentials, or create backdoors for authentication bypass.
Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.
This rule detects unauthorized modifications or creations of files within critical Linux Pluggable Authentication Module (PAM) directories (such as /etc/pam.d/ and /lib/security/). Attackers often target these files to implement backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common package management tools to minimize false positives.
Detects instances where DllHost.exe creates executable or script files within common writable directories such as Users, ProgramData, or Windows\Temp. This behavior is often indicative of an adversary staging malicious payloads or scripts to facilitate further execution.
Page 120 of 217