Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
Detects the Miasma worm utilizing the Bun runtime to execute malicious payloads. The detection looks for Bun processes executing scripts from /tmp/, specifically patterns associated with the Miasma worm, or processes matching the known malicious Bun runtime hash.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of malware staging, temporary file execution, or attempts to clean up forensic evidence.
This rule detects the creation, modification, or renaming of files that are explicitly named after known security research projects, proof-of-concept exploits, or common testing artifacts (e.g., pedit_cow_demo, packet_edit_meme). These files are often associated with exploit development or security testing activities.
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
Detects the creation or modification of '.amazonq.mcp.json' files associated with the Model Context Protocol (MCP) in VS Code or similar IDE environments, alongside the subsequent spawning of shell interpreters (bash, sh, cmd, powershell, python, npx) from these IDE processes. The rule further flags these events as 'HIGH' priority if the command line references sensitive patterns like AWS credentials or SSH/AWS paths, suggesting potential credential harvesting or unauthorized post-exploitation activity originating from the IDE environment.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects the creation of executable or script files within the Windows Startup folder where the parent process is WinRAR.exe. This activity is a common indicator of an adversary leveraging a self-extracting archive or malicious file extraction to achieve persistence by placing a payload in the user's startup directory.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects the WinRAR process creating or modifying files within the Windows Startup folder. This activity is a common technique used by attackers to achieve persistence by ensuring that a malicious payload or script is executed automatically upon user logon.
Detects instances where the WinRAR process is used to create or modify files within the Windows startup directory. This behavior is highly suspicious and often indicates an adversary attempting to establish persistence by placing a malicious script or executable in a location that executes automatically upon user login.
Detects the 'lambsys' malware terminating competing cryptocurrency miner processes (such as xmrig, kinsing, or watchdog) using process termination commands (pkill, kill, killall) from a non-root shell. The detection further correlates this activity with the launch of a new miner binary from temporary directories and subsequent outbound network connections to common mining pool ports.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
Detects the Lambsys cryptominer malware performing SSH credential harvesting by accessing user SSH keys (known_hosts, authorized_keys, id_rsa) with unauthorized processes, staging these files in temporary or hidden directories, and subsequently initiating outbound SSH connections for lateral movement, all correlated by process group ID.
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
Detects persistence mechanisms used by the lambsys/procq cryptominer. It identifies two specific behaviors: 1) Correlation of non-root process execution (isp.sh, lambsys, procq) followed within 120 seconds by modifications to cron configuration files (e.g., /etc/cron.d/, /var/spool/cron/crontabs/) containing suspicious command-line patterns or mining pool references. 2) Direct detection of crontab -e invocations using heredoc redirection (<<) to install persistence payloads that match known miner dropper patterns and mining pool endpoints.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
This rule detects the creation of Electron application runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual or suspicious AppData\Local subdirectories. This behavior is associated with the Ghost ClickFix attack chain, where compromised systems are used to deploy malicious Electron applications. The rule specifically looks for file creations in paths matching `\appdata\local\(super|max|util)[^\\]*` and installer executables named `utilifysetup.exe`, `setup.exe`, or `is-[a-z0-9]+\.exe`.
Detects persistence mechanisms associated with ModeloRAT, specifically monitoring for suspicious Registry Run key entries, scheduled tasks, and startup folder items that execute 'pythonw.exe' or 'WPy64-31401' based binaries.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Page 132 of 217