Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
Detects signs of active exploitation of the PHP857 vulnerability. The rule identifies suspicious behaviors associated with this RCE, including the spawning of shells by PHP processes, access to sensitive memory maps (/proc/self/) for ASLR bypass, and the creation of specific indicator files or execution of proof-of-concept strings.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
This rule detects attempts to install custom Certificate Authority (CA) certificates on Linux systems using common utilities. Adversaries may install root certificates to subvert trust controls, allowing them to intercept encrypted traffic or sign malicious code without triggering security warnings. The rule specifically looks for these utilities being used to interact with common CA certificate directories, while excluding a placeholder for legitimate custom CA installations depending on your environment.
Detects file creation or write operations involving file paths containing the string 'SysMain_5874288'. This pattern is often associated with adversary attempts to drop, stage, or modify files using names designed to masquerade as legitimate system components or services, potentially to maintain persistence or evade detection.
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects file creation events related to known GLASSWORM VS Code extension files or WebAssembly (WASM) loader JavaScript shims. It also identifies process execution where the VS Code extension host spawns 'node.exe' with known GLASSWORM JavaScript shims. This rule aims to identify the presence and execution of the GLASSWORM malware.
This rule detects suspicious activity related to GitHub Actions workflows, including the creation or modification of workflow configuration files, the placement of suspicious JavaScript files in the repository's .github directory, the execution of the 'Bun' runtime within an Actions runner environment, and cloud-based events indicating workflow modification containing 'Run Copilot' strings. These patterns are often associated with CI/CD pipeline compromise, malicious automation, or unauthorized code execution within build environments.
Detects file creation or modification events within the Windows Credential Vault folder (AppData\Local\Microsoft\Vault), excluding legitimate activity by the 'vaultsvc.exe' process. This could indicate an attempt to access, modify, or exfiltrate stored credentials.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects the execution or creation of files named GT_NET.exe or Gt_net.exe, which are associated with the Grixba ransomware (Play Ransomware group). The rule also identifies files that masquerade as SentinelOne by utilizing SentinelOne-related product, company, or description metadata but are located outside of the legitimate SentinelOne installation directory.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects attempts to perform a container escape using the 'docker cp' command, where a maliciously crafted source path with traversal sequences allows the container daemon to write files outside of the container boundary. The rule monitors for suspicious 'docker cp' command executions and the creation of artifacts associated with known path traversal escape techniques in the host filesystem by the Docker daemon.
This rule monitors for the presence of known exploit harness binaries associated with CVE-2026-55200 on disk or in command lines, and identifies post-exploitation activity where common network utilities (curl, git, php) execute unsigned or suspicious child processes, which often indicates lateral movement or payload staging.
This rule detects suspicious activity originating from an OpenVPN process by correlating the creation of temporary files (common for dropped payloads) with the subsequent execution of shell interpreters (e.g., cmd.exe, powershell.exe, bash) within a 120-second window on the same host. This pattern suggests potential exploitation or post-exploitation activities where OpenVPN is leveraged to drop and execute malicious secondary tools.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects potentially unauthorized or suspicious usage of the RustDesk remote access tool. The rule monitors for connections from new peer IDs, the spawning of command shells (cmd.exe or powershell.exe) by the RustDesk process, and the writing of executable or sensitive file types by RustDesk to non-standard directories.
Page 127 of 217