Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or writing of executable binary files (e.g., .exe, .dll, .bat, .ps1, .vbs, .scr) to sensitive Windows administrative shares (ADMIN$, C$, IPC$) via SMB. This behavior is indicative of lateral movement where an attacker attempts to stage tools or scripts on a remote system for subsequent execution.
Detects creation or modification of files under /etc/sudoers or /etc/sudoers.d/ by a
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
process outside sanctioned package- and configuration-management tooling. Writing a
passwordless sudo rule is the finishing move in CIFSwitch (CVE-2026-46243) and OVSwrap
(CVE-2026-64531) and a common root-persistence step generally. Enriched with writer
context (non-root, writable-path, shell one-liner, NOPASSWD) and a heuristic RiskScore /
TriagePriority, plus DeviceInfo host context (MachineGroup, OS, logged-on users).
Detection logic adapted from Elastic Security Labs - Linux LPE detection framework.
Detects a behavioral fingerprint associated with the NeedyMantis group, characterized by the creation of a DLL and a identically-named, extensionless, encrypted archive file in the same directory within a short time window. This approach identifies the underlying packaging strategy rather than relying on static file names or known paths.
Detects .ps1-named files dropped to disk that are never actually executed by a PowerShell interpreter (powershell.exe / pwsh.exe) within a short window afterward. NeedyMantis's second-stage loader (e.g. encryptbase64.ps1) is raw x64 shellcode, not a real script -- it's read and executed directly by the dropping process, so no genuine PowerShell host process ever references the file by name. Replaces an earlier version of this rule that watched DeviceImageLoadEvents for a .ps1 extension: Windows can only emit an image-load event for a file with a valid PE header loaded via the OS loader, and raw shellcode has no PE header and is never mapped that way, so that approach would not have fired on this malware. Caveat: legitimate deployment tooling that stages a script for delayed or remote execution can also produce this create/execute mismatch; tune the window and add known-good deployment-tool exclusions for your environment.
Detects a process obtaining handle access to the LSASS process (Sysmon Event ID 10) followed by the creation of a file (Sysmon Event ID 11) using an extension other than '.dmp'. This behavior is characteristic of adversaries attempting to obfuscate credential dumping activities by bypassing simple extension-based detection rules.
Detects the creation of files commonly associated with ransomware notes (e.g., README.txt, HOW_TO_DECRYPT.txt) across multiple directories, which is a strong indicator of the impact phase where files have been encrypted and the adversary is providing recovery instructions.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
This rule detects the creation or presence of specific file artifacts ('PDF_C2089_20260911100446.exe' and 'active_desktop_render_x64.dll') within the '\AppData\Microsoft\Update\' directory. These file names and paths are characteristic of potential malware staging or persistence mechanisms, specifically associated with the SilverFox threat activity.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
This rule performs a retrospective search across device file and network events for indicators of compromise associated with the UNC6240/ShinyHunters actor's activity against PeopleSoft, specifically linked to CVE-2026-35273. It monitors for known malicious file hashes (JSP webshells and executables), connections to known C2 infrastructure, and DNS lookups for specific malicious domains.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects activity associated with the SharePoint ToolShell exploitation chain, specifically monitoring the w3wp.exe process for spawning suspicious child processes like cmd.exe or powershell.exe, and the creation of unexpected .aspx files within the SharePoint LAYOUTS directory.
Detects the execution of rundll32.exe or regsvr32.exe where the command line arguments reference a DLL that was recently written to the disk on the same host. This behavior is indicative of a RAT or malware dropping a secondary payload (DLL) and immediately executing it using built-in Windows binary proxies to bypass security controls.
Detects the CARBONATO GH0ST Hermes Agent activity of harvesting and storing AI API keys (such as OpenAI, Anthropic, Google Gemini, etc.) as plaintext files within the /root/.hermes/loot/ directory. This is consistent with the agent's behavior of staging credentials for later exfiltration.
Detects post-compromise activity associated with the NeedyMantis group, specifically the staging of a legitimate binary alongside a malicious DLL and a paired archive, followed by the execution of the legitimate binary to trigger DLL side-loading. This activity is typically preceded by Impacket-style remote command execution (e.g., wmiexec, smbexec, atexec).
Detects the creation or renaming of files to a .aspx extension within specific web application directories (member file-upload). The rule specifically filters for file operations initiated by the IIS worker process (w3wp.exe) and requires a non-zero file size, identifying potential web shell deployment attempts.
Detects the LEMURLOOT ASP.NET web shell deployed by Cl0p following exploitation of CVE-2023-34362 in MOVEit Transfer
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe) by the Microsoft Exchange IIS worker process (w3wp.exe) or the creation of .aspx files in Exchange web directories. This behavior is highly indicative of post-exploitation activity, such as web shell deployment, frequently observed in attacks targeting vulnerabilities like ProxyShell and ProxyLogon.
Detects a file named dnsapi.dll created/modified outside System32/SysWOW64/WinSxS (the only legitimate locations for the real system DLL). Now requires the file to BOTH land in one of the known NeedyMantis sideload staging folders AND match the published 3448-byte spoofed-config size -- previously the size check alone could match unrelated dnsapi.dll copies anywhere on disk; requiring both signals together removes that bypass.
Page 13 of 217