Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects the execution of Sysinternals ADExplorer. The rule specifically alerts when the utility is executed with the '-snapshot' flag and targets a file with a .dat extension, which is a technique used to perform unauthorized Active Directory enumeration and offline extraction of sensitive directory data.
Detects the creation of sequentially numbered JPEG files within timestamped subdirectories of C:\Users\Public\Videos. This activity is consistent with the behavior of the SIGHTGRAB utility, a tool used by the threat actor UNC1549 for intelligence gathering through automated desktop screenshots.
Detects evidence of the MYRA Linux RAT, which uses LD_PRELOAD hijacking via a malicious library located at /usr/local/lib/.libcache.so for persistence or execution flow hijacking. The rule also identifies the malware's practice of masquerading as the 'systemd-userdbd' service, often launched from a Node.js-based environment.
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects persistence mechanisms via Registry Run keys or Startup folder shortcuts created by PowerShell, WScript, or CScript that are associated with the Gamaredon (ACTINIUM) threat group. The rule correlates these persistence events with prior execution of Ptero-family malware or suspicious encoded PowerShell commands on the same endpoint within a one-hour window.
Clipboard and screenshot staging pair
Cortex XDR
This rule detects the creation of 'Clipboard.txt' and 'Screenshot.bmp' files by the same process, indicating potential data staging activities. It leverages XQL to maintain actor and causality fields for investigation.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
Detects the use of the AWS CLI to extract Secrets Manager values and potentially STS tokens, writing them to local text files in the /tmp directory. This activity is indicative of an attacker attempting to exfiltrate credentials or sensitive information.
This rule detects potential data exfiltration activity where PowerShell is used to compress files followed by an outbound network connection to a known C2 IP address and port. It also monitors for direct outbound connections from PowerShell involving suspicious keywords indicative of data staging and exfiltration such as 'Compress-Archive', 'client.zip', and 'UPLOAD'.
Detects the creation of the file 'logs.dat' within the 'AppData\Roaming\DT' directory, which is a known artifact for keylogging output generated by the Remcos RAT. The detection flags this activity when performed by suspicious processes.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
This rule detects the creation of files or directories associated with known suspicious or malicious browser extension IDs within the Microsoft Edge User Data folder. It monitors for the writing of new executables, scripts, or directory creation events that match specific, potentially malicious extension GUIDs.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Detects the creation of persistence mechanisms, specifically cron jobs or LaunchAgent plist files, initiated by the OpenClaw agent process tree (openclaw, openclaw-runtime, openclaw-agent). This behavior is associated with ClawHub skills attempting to maintain C2 access after the skill itself has been removed.
Detects unauthorized modifications to SSH authorized_keys files and changes to SSH configuration (specifically PermitRootLogin) on Cisco SD-WAN controllers, which may indicate persistence or unauthorized remote access attempts.
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
Detects the creation of files with names containing 'winPatch' and extensions of '.zip' or '.vbs' in Windows TEMP directories, originating from PowerShell or WScript processes. This behavior is indicative of potential ingress tool transfer or staging of malicious scripts.
Page 126 of 217