Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects malicious activity associated with the GIFTEDCROOK (UAC-0226) threat actor. It identifies the use of PowerShell or cmd.exe to execute staged files from specific ProgramData paths (WC3, wt1), monitors for common NT API-based reflective injection patterns (such as NtAllocateVirtualMemory and NtWriteVirtualMemory) originating from PowerShell, tracks the creation of known staging artifacts in ProgramData, and identifies the execution of known malicious process image hashes.
Detects file creation events associated with the UAC-0226 campaign, specifically targeting Ukrainian military-themed lures and staging artifacts related to the GIFTEDCROOK malware. This rule monitors for the presence of specific file paths and naming conventions indicative of ongoing espionage operations.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
This rule detects various persistence mechanisms and configuration tampering techniques often associated with compromised development environments. Specifically, it monitors for the creation of LD_PRELOAD libraries in common directories, unauthorized modifications to shell profile scripts, suspicious cron job creation by Node/NPM processes, and the poisoning of configuration files for IDEs and AI coding assistants (e.g., Claude, Cursor, VSCode). It also detects the execution of suspicious Node.js scripts used as session hooks.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
This rule detects indicators of compromise associated with the TinyRCT malware, including the loading of a malicious AppDomainManager DLL by chrome_setup.exe, network connections to a known TinyRCT staging server, and the dropping of second-stage payloads such as PerfWatson2.exe to the local application data directory.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects the creation or modification of the .amazonq/mcp.json file in a workspace directory. This file is automatically loaded by the Amazon Q VS Code extension and can be leveraged to achieve remote code execution (RCE) via malicious MCP server command definitions as documented in CVE-2026-12957.
Detects anomalous file activity on removable media drives characteristic of the Gamaredon group's PteroOdd/PteroSetup malware. The rule identifies PowerShell, wscript.exe, or cscript.exe writing autorun.inf or .lnk files to removable drive letters (D-Z), which is a common technique for lateral movement and propagation via USB drives.
Detects instances where the WinRAR utility process creates, writes, or drops a file into the Windows Startup folder. This behavior is a common technique used by adversaries to achieve persistence, as any executable placed in this folder will automatically run upon user login.
Detects execution artifacts and prerequisite activities associated with the DirtyClone (CVE-2026-43503) local privilege escalation exploit. This includes monitoring for the creation of unprivileged user namespaces, loading specific kernel modules (esp4, esp6, rxrpc) often used in such exploits, compilation of associated exploit source files, and direct interaction with /proc/self/mem to perform memory-based exploitation.
This rule detects the creation of directories or files within /var/tmp that use the hidden naming convention (dot-prefix), specifically looking for '.xlamb' or '.x'. Such hidden directories in temporary storage locations are commonly used by attackers for staging malicious tools, malware, or backdoors.
Detects the creation of image-related files with generic names in common temporary or user download directories that fall within a specific file size range (100KB-1000KB). These characteristics are often indicative of steganography where malicious payloads or data are embedded within seemingly benign image files to bypass security controls.
Detects the creation of files within the Windows Startup directory. Adversaries use this folder to achieve persistence by ensuring that malicious files or shortcuts are executed automatically when a user logs in.
Detects unauthorized modification or dropping of model files directly into the local Hugging Face cache directory (~/.cache/huggingface/hub) by non-standard development processes, indicating an attempt to swap legitimate models for backdoored ones.
This rule monitors for suspicious activity related to Microsoft Exchange server exploitation and persistence techniques. It detects three distinct behaviors: the creation of web shell files (.aspx, .ashx, .asmx) within Exchange directories (OWA/ECP), the spawning of shell processes (cmd, powershell) by the w3wp.exe web server process, and DLL sideloading occurring through identified signed binaries (dfsvc.exe, rasautou.exe) outside of standard system directories.
Identifies the creation of network scanning tools (e.g., Advanced IP Scanner, Netscan) within SimpleHelp cache directories, which could indicate a threat actor staging tools for reconnaissance.
Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.
This rule detects potentially malicious behavior associated with web browser processes, including the execution of Python scripts, the loading of browser extensions from non-standard directories like AppData or Temp, the creation of Python scripts by browsers in temp folders, and outbound network connections by Python processes following browser activity. These patterns are often associated with browser-based exploitation, extension-based malware, or initial access stages where a browser is used as a conduit for malicious code execution.
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
This rule monitors for the creation of specific file artifacts associated with the APT28 SimpleLoader malware, including malicious DLLs, steganographic image payloads, and configuration files dropped into non-standard or diagnostic directories.
Page 128 of 217