Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Detects the creation of multiple archive files (ZIP, 7Z, RAR, TAR) by common utilities (7z, WinRAR, tar) in sensitive temporary directories (Temp, tmp). The rule aggregates activity over a 10-minute window to identify suspicious staging behaviors often associated with ransomware data preparation.
This rule detects indicators of the 'RoguePlanet' exploit, which leverages ISO image mounting to stage malicious files. It monitors for the execution of Windows Error Reporting (wermgr.exe) from virtual CD-ROM devices, unauthorized use of PowerShell to mount DiskImages or VHDs, and the creation of specific filesystem paths (RP_<UUID> directories) commonly associated with RoguePlanet exploit activity.
This rule detects the creation or execution of files named 'winupdate.exe' and specific patterns of Python script execution within user-writable 'AppData' subdirectories, specifically targeting the '.cache' folder. This behavior is indicative of potential malware staging or execution, often associated with obfuscated payloads or unauthorized software running in non-standard user locations.
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
This rule detects the execution and creation of suspicious files named 'winupdate.exe' or 'SLaunch.exe' within the AppData cache directory, or processes involving 'YutaCore.dll' or a specific local host URL. It also checks for the execution of known malicious file hashes associated with this behavior.
Detects the RoguePlanet quarantine artifact hijack technique, which involves two primary signals: the staging of 'wermgr.exe' within temporary 'RP_*' working directories and the unauthorized creation or modification of 'wermgr.exe' in 'C:\Windows\System32' by processes other than trusted Windows system components.
Detects anomalous activity involving the Windows Error Reporting service executable, wermgr.exe. This includes the suspicious creation of files within temporary directories that match known junction-based exploitation techniques, the creation of a 'wdtest_temp' subdirectory (often used as a working directory in exploit staging), and the execution of wermgr.exe from a path other than the expected Windows System32 directory.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
This rule detects high-frequency file creation events where files are named with potential UUIDs within subdirectories of the 'Temp' folder matching the 'RP_' pattern. This activity is indicative of automated staging or data manipulation by a user-mode process, filtering out activity from system-level accounts.
This rule monitors for suspicious activity involving wermgr.exe and Windows Defender quarantine directory. It detects wermgr.exe being written to or executed from non-standard temporary paths (often associated with potential junction-redirected payload execution), non-MsMpEng processes writing to the Windows Defender quarantine folder, and the creation of NTFS Alternate Data Streams (ADS) named :WDFOO within temporary directories.
Detects persistence attempts on Linux edge appliances by monitoring for suspicious modifications to cron job directories, system initialization scripts (RC init), and the execution of specific binaries associated with common persistence mechanisms.
This rule detects suspicious activities commonly associated with the Yuta/Glove information stealer, including the creation of specific file paths in AppData, the execution of binaries from user-writable directories, and potential process hollowing or side-loading behaviors. It monitors process creation (Event ID 1) and file creation (Event ID 11) for indicators like winupdate.exe, PyInstaller-related temporary directories, and known malicious file hashes.
Detects evidence of Yuta/Glove Stealer malware establishing persistence. The rule monitors for unauthorized registry modifications to Windows Run keys pointing to suspicious paths (AppData, Temp) or specific files ('winupdate.exe'), and the creation of files within the Windows Startup folder using specific naming conventions such as 'WindowsDefenderAgent' or 'winupdate'.
This rule monitors for the execution of QEMU processes and the creation of virtual disk files (.qcow2, .vmdk) in non-standard locations. It also identifies potentially disguised VM images by detecting files with suspicious extensions (.db, .dll) created in sensitive paths like Temp or AppData, which may indicate an attempt to hide virtualized environments or disk images.
This rule monitors for the creation or modification of files containing the string 'readme_locker' in their filename. This pattern is commonly associated with ransomware strains that leave behind ransom notes, often as part of the data encryption impact phase.
Page 134 of 217