Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects unauthorized access (creation, modification, renaming, or deletion) to sensitive local credential files by the Node.js runtime process (node.exe/node). This behavior is indicative of infostealers, specifically noted in the Miasma/MYRA activity associated with the Polymarket Trap campaign, where malicious packages attempt to exfiltrate AWS, SSH, NPM, Python, Docker, and GPG credentials.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
Detects periodic screen captures being written to the AppData\Roaming\Screenshots directory with specific timestamped naming patterns (time_YYYYMMDD_ or wnd_YYYYMMDD_) often used by Remcos RAT to exfiltrate user activity.
This rule monitors for suspicious file creation and process execution indicative of the Remcos Remote Access Tool. It specifically looks for the creation of files containing 'keylogger.dat' or 'logs' in the user's AppData directory, as well as the execution of processes with 'remcos.exe' or 'remcos' in the path or command line arguments, signaling potential keylogging or remote control activity.
This rule detects the creation or modification of files that contain common certificate-related keywords such as 'crl', 'certificate', or 'pem'. This activity could indicate the deployment of new certificates, which might be legitimate or malicious, such as for establishing command and control, code signing, or evading detection.
Detects the creation of files containing keywords such as 'vulnerability', 'assessment', or 'scan'. This rule aims to identify activities related to vulnerability scanning or security assessments being performed on a system, potentially indicating reconnaissance or unauthorized activity. The events are summarized by the initiating process account name and time to help identify the source of these activities.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.
Detects the creation of a 'keylogger.dat' file in common writable directories (AppData, Temp, ProgramData) by non-standard system processes. This is a behavioral indicator commonly associated with the Remcos Remote Access Trojan (RAT), which uses low-level keyboard hooks to capture input and save the data to a local file for exfiltration.
Detects exploitation of the Flowise MCP environment variable case-sensitivity bypass vulnerability. Adversaries leverage this flaw to circumvent denylist validation by supplying lowercase or mixed-case variable names (e.g., node_options), facilitating malicious code preloading via '--require', unauthorized environment secret exfiltration, or spawning child processes from the Flowise application.
Detects potential BaoLoader drive-by compromise attempts by monitoring two stages: first, the creation of executable files in temporary or application data directories by browser processes; and second, the execution of command-line shells by processes running from those same directories where the browser acted as the grandparent.
Detects file creation or modification events targeting sensitive cloud credential storage locations, such as AWS credentials files, Azure configurations, and Google Cloud credentials databases. The rule filters out known legitimate CLI tools, flagging potential unauthorized access or exfiltration of cloud credentials by other processes.
Detects file creation or modification events targeting sensitive cloud credential storage locations, such as AWS credentials files, Azure configurations, and Google Cloud credentials databases. The rule filters out known legitimate CLI tools, flagging potential unauthorized access or exfiltration of cloud credentials by other processes.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects instances where PowerShell is invoked with an execution policy bypass flag to copy the 'curl.exe' binary from its legitimate System32 location to user-writable directories (such as AppData, Temp, or Public folders) and renaming it. This activity is often associated with adversaries attempting to evade security controls by masquerading legitimate system utilities.
Detects the creation of a hidden shell script file at '/etc/profile.d/.sh.local', a common persistence mechanism used by the MYRA RAT. This file is automatically executed by POSIX-compliant shells during the login process to maintain persistence on Linux systems.
Detects a sequence of events where a cloud storage bucket is deleted and then immediately recreated with the same name. This pattern is indicative of a potential bucket hijacking attack, where an adversary attempts to take ownership of a bucket to intercept data streams, such as logging sinks, application data, or replication traffic.
Detects the creation of a LaunchAgent property list (.plist) file on macOS that uses a spoofed Apple namespace label (com.apple.system.services.activity). This behavior is characteristic of the Gaslight malware family attempting to establish persistence.
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
Page 123 of 217