Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the presence or activity of a known malicious Chromium-based browser extension (Perplexity AI imposter, ID: flkebkiofojicogddingbdmcmkpbplcd) through monitoring file system changes in browser directories, registry modifications, or network communication with identified command-and-control infrastructure.
Detects the creation of image files (e.g., .bmp, .png, .jpg) in temporary or specific working directories by processes associated with BeepRAT (HFY.exe, tcc.exe, LuaJit.exe). This activity is indicative of the RAT executing screen capture commands to exfiltrate desktop imagery.
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers. Gentlemen operators rapidly deploy new BYOVD proofs-of-concept to evade and disable host defenses by dropping known vulnerable drivers to disk.
Detects the creation of a 'linux-process-env.json' artifact by a Node.js process. This file is typically generated by the Djinn Stealer malware as part of its 'collectLinuxProcessEnv' function, which enumerates system process command lines and environment variables from the /proc directory after initial compromise.
Detects the installation of a malicious Chromium extension masquerading as 'Search for perplexity ai'. The rule monitors for file creation events in the Chrome extensions directory matching the specific malicious extension ID, modification of the Chrome Preferences file, and outbound network connections from the browser to the identified C2 domain.
Detects suspicious behavior originating from OpenVPN processes, including spawning command-line interpreters (cmd, powershell, etc.), utilization of server-pushed configuration directives that trigger script execution (e.g., up, down, or route-up hooks), and the creation of scripts or executables within temporary directories.
Detects the creation or modification of specific suspicious files (e.g., MediumInstStart.exe, SolidPDFCreator.dll, pcl2bmp.exe, ctxmui.dll) in common temporary or world-writable directories like ProgramData or Users/Public/Documents, which are often used by adversaries for staging tools or malware components.
Detects the creation or modification of suspicious Launch Agent or Launch Daemon .plist files, or a hidden application support directory, masquerading as 'com.apple.accountsd' on macOS. This behavior is often indicative of persistence mechanisms used by adversaries.
Detects creation of systemd service unit files for Linux persistence
This rule detects the creation or modification of specific script files in common Linux persistence locations: '/etc/profile.d/' or '/usr/local/lib/'. Adversaries may modify or create scripts like '.sh.local' or '.cache-update.sh' in these directories to establish persistence, as these scripts can be executed automatically during system boot or user login.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Detects the creation of hidden tracking files (.pkg_history and .pkg_logs) in the system's temporary directory. These markers are dropped by the setup.cjs dropper as part of the easy-day-js typosquat in the Mastra npm supply chain compromise.
Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Detects the creation of files on web servers matching known Neo-reGeorg web shell tunnel variants. These files are typically used as backdoors to tunnel traffic and provide persistent access to the server.
This rule detects the execution of scripts and commands associated with known SAP RFC exploitation attempts, including specific shell scripts used for RCE or credential extraction, as well as the invocation of SAP function modules like SXPG_CALL_SYSTEM for OS command execution. These patterns are consistent with post-exploitation activity or unauthorized system administration in SAP environments.
This rule detects activities associated with CORS-based exploitation and session token harvesting, specifically targeting the creation or access of known exploit files (e.g., cors_exploit_poc.html) and the use of command-line tools (curl, wget, PowerShell) to interact with suspicious artifacts or session tokens (AMAUTHID/SAT).
Detects a browser creating a ZIP archive whose name impersonates a GPU, disk, temperature, codec, or PDF utility associated with high-performance systems. This activity is often associated with poisoned search results leading to cryptojacking campaigns.
Detects access, copying, or creation of files within common cryptocurrency wallet directories, as well as registry lookups related to Bitcoin data directories. This behavior is often indicative of info-stealing malware or an adversary attempting to exfiltrate digital currency assets from a compromised host.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects attempts to exploit the PwnKit vulnerability (CVE-2021-4034) in Polkit's pkexec. The rule monitors for malicious command-line arguments involving GCONV_PATH environment manipulation, the execution of pkexec by non-root users, and the presence of associated PwnKit payload artifacts, such as base64-encoded strings or specific chunked files.
Page 125 of 217