Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule monitors for the execution and network activity of known data exfiltration tools such as WinSCP, rclone, and MegaSync. It also tracks the creation of configuration files associated with these tools and monitors DNS requests and browser navigation to known cloud storage and file-sharing destinations. This behavior is indicative of data staging and unauthorized exfiltration.
This rule detects potential re-compromise attempts by monitoring for access, file creation, or process execution associated with a set of known malicious web shell files. It correlates IIS web server logs (HTTP POST requests to shell files), EDR file modification events, and EDR process spawning events from common web server binaries (w3wp.exe, coldfusion.exe, jrun.exe) to identify persistence remaining after remediation.
Correlates the BackgroundFix script execution with the unauthorized dropping and unpacking of malicious browser extensions into Chrome/Edge local app data paths. Specifically, it detects file creation events in browser extension directories when initiated by 'wscript.exe'.
Detects indicators of Akira ransomware activity, including execution of the binary, dropping of ransom notes, renaming of files with .akira extension, and the use of vssadmin to delete volume shadow copies.
Detects the modification or creation of .aspx files within the ColdFusion 'wwwroot\Images' directory. The rule flags both known webshell filenames and generic .aspx files that are not modified by the IIS worker process (w3wp.exe), which is indicative of unauthorized file manipulation or webshell deployment.
Detects the addition of Microsoft Defender exclusions (Path, Extension, or Process) via WMIC or PowerShell, followed by a file creation event within a suspicious directory (e.g., Temp, AppData, ProgramData) within 15 minutes. This behavior is indicative of an adversary attempting to bypass antivirus detection for malicious payloads.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects GreenBlood ransomware or similar threats accessing Outlook PST/OST/EML/MSG email files from non-Outlook processes, potentially indicating data theft for double extortion. The rule specifically looks for file read, access, or creation actions on these email file types within common Outlook or user data folders, excluding legitimate processes that typically interact with these files.
Detects artifacts associated with the Remcos RAT keylogger, specifically the creation or modification of 'logs.dat' within 'AppData\Roaming\DT' and the registration of a 'WH_KEYBOARD_LL' hook via 'SetWindowsHookEx' API calls, which is indicative of keylogging functionality.
This rule detects the execution of PowerShell scripts (.ps1) that were recently created in the AppData\Local\Temp directory. It specifically looks for PowerShell processes launched with parameters indicating a hidden window, no profile loading, and a bypass execution policy, which are common characteristics of malicious PowerShell activity.
This rule detects attempts to establish persistence by modifying Registry Run keys or creating files in Startup folders, specifically when the initiating process is 'explorer.exe'. This behavior is often associated with malware injecting into explorer.exe to maintain persistence.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
Detects instances where processes not associated with standard web browsers (e.g., node.exe) attempt to create, modify, or rename browser-related sensitive files, specifically cookie databases and DPAPI-protected Local State files. Such activity is often indicative of credential and session cookie theft.
Detects DLL sideloading behavior associated with Operation DragonReturn (Silver Fox), specifically identifying the loading of 'nvdaHelperRemote.dll' by 'Mixed Reality.exe' and the creation of the DLL in the Windows Media Player directory by unauthorized processes.
This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
This rule detects the presence of a specific malicious Chrome extension ID (flkebkiofojicogddingbdmcmkpbplcd) in process command lines or file paths on Windows endpoints, originating from browser processes such as Chrome, Edge, or Brave.
Detects the use of Node.js package managers (npm, node, npx) to execute 'install' commands in conjunction with the creation of specific Model Context Protocol (MCP) configuration files (.vscode/mcp.json, .amazonq/mcp.json, or .cursor/mcp.json). This pattern may indicate the installation of potentially untrusted or malicious development extensions or AI-assistant integrations within common development environments.
Detects execution of potential BeepRAT shellcode loaders (tcc.exe or LuaJit.exe) using specific command-line arguments, as well as the creation of associated files (temp.bin, config.ini.c) or execution patterns initiated by HFY.exe.
Page 124 of 217