Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
This rule detects the creation of large files (1MB or greater) with names suggestive of exfiltration or staging (e.g., containing 'exfil', 'stage', 'batch', 'zip', 'archive') in common temporary or public user directories. This behavior can indicate an adversary preparing data for exfiltration.
Detects suspicious image loads where a renamed Microsoft .NET ClickOnce Launch Utility or other .NET masquerading binaries sideload mscoree.dll or msvcp140.dll from the ProgramData directory. This behavior is associated with the Lorem Ipsum threat activity.
Detects the creation or writing of BMP files in temporary directories by processes other than common screenshot or image editing tools. This activity can be indicative of malware attempting to capture screenshots or other visual data, potentially for exfiltration or analysis.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
Detects user execution of malicious files downloaded via email link clicks
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers.
Detects LCRYX ransomware components executing via wscript.exe or cscript.exe to download secondary malicious payloads using MSXML2.ServerXMLHTTP and ADODB.Stream, targeting the C:\Windows\ directory. The rule matches on specific C2 domains/IP addresses and known file drop paths associated with multi-stage malware infections.
Detects the execution of BloodHound or SharpHound Active Directory enumeration tools followed by the creation of a 'bloodhound.zip' archive, which is commonly used to exfiltrate collected Active Directory mapping data.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Detects evidence of Argamal RAT activity involving screenshot capture using .NET Graphics.CopyFromScreen methods written to a specific temporary file (~wra1269.tmp). The rule monitors both PowerShell execution patterns and file creation events associated with this specific artifact.
Detects behavior patterns associated with the LCRYX ransomware, specifically lateral movement via WMI (wmic.exe), network subnet scanning, file copy operations to remote SMB shares, and the dropping or execution of VBScript artifacts on removable or non-system drives.
Detects the creation of image files (JPEG, BMP, PNG) in temporary system directories by processes not associated with standard UI, browser, or imaging applications. This behavior is indicative of infostealer malware, such as StealC or Amadey, using GDI APIs like BitBlt or CreateCompatibleDC to capture desktop screenshots.
Detects persistence mechanisms associated with the MYRA RAT on Linux systems, including the creation or modification of cron jobs (specifically targeting .cache-update.sh), registration of a malicious shared object via /etc/ld.so.preload, and the installation of a login hook in /etc/profile.d/.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects the file-based installation of known malicious Chrome extensions (specifically Adblock for YouTube, Adblock for Chrome, Adblock for You, and AdBlock Suite) that contain mechanisms for executing remote malicious scripts.
Detects the presence of known malicious variants of the 'Adblock for YouTube' Chrome browser extension within the user's Chrome extensions directory. These extensions are flagged for utilizing broad host permissions to maintain persistent silent access and potential remote code execution via fetched scriptlets.
Detects the creation or modification of VS Code tasks.json files containing the folderOpen trigger by non-editor processes. This technique can be abused to achieve automatic code execution when a project folder is opened, a method known to be used by malicious npm packages to execute payloads disguised as benign files.
Page 130 of 217