Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects the creation of files commonly used as ransom notes (e.g., 'readme_locker' or 'readme_locker.txt') within common user directories such as the Desktop. This behavior is a strong indicator of a ransomware attack post-encryption.
Detects the creation or modification of specific DLL and data files associated with the SharkLoader malware (e.g., SystemSettings.dll, DscCoreR.mui) within designated hidden directories (%APPDATA%\xwreg or %APPDATA%\xgdf). These paths are indicative of the StrikeShark campaign, which utilizes DLL side-loading to target diplomatic and government entities.
Detects the creation of a file named '__RestoreYourFiles__.txt' within the Microsoft Word STARTUP folder. This file name and location are commonly associated with ransomware activity, specifically the BlackByte ransomware, which drops this file as a ransom note.
Detects modern phishing tradecraft where malicious JavaScript is embedded inside SVG image files. The browser evaluates the SVG, decodes a Base64 payload, and drops a secondary archive or executable directly to disk via Blob/Data URIs. This rule specifically looks for file creation events in the Downloads folder for common executable or archive file types, correlated with browser processes (Chrome, Edge, Firefox) accessing local SVG files.
Detects the initial file drop of the TiFlux RMM binaries (often disguised or renamed) executing from untrusted locations like Downloads or Temp.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects the presence of specific file extensions (.p2k, .3396bw_p2k) often associated with ransomware activity, as well as the creation of 'HowToRestoreFiles.txt' which is a common indicator of a ransom note file.
Detects the creation of potentially malicious archive files (.zip, .iso, .img, .cab) in the Downloads folder, initiated by web browsers (Chrome, Edge, Firefox), where the initiating process's command line indicates a local file access (file:///), suggesting a Blob-to-Disk dropper technique often associated with AI-obfuscated phishing campaigns.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Detects suspicious file creation or execution of Node.js scripts linked to VS Code or .claude directories. This behavior often suggests the presence of poisoned IDE configurations or malicious task automation attempts designed to execute code when a project or IDE folder is opened.
Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.
Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).
Detects process execution or file creation/modification events associated with the PACKET_EDIT_MEME (pedit_cow_demo) exploit, which targets Linux kernel vulnerabilities (CVE-2026-46331) for local privilege escalation.
Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.
This rule monitors for potential keylogging behavior by detecting the use of Windows hooks (SetWindowsHookEx, GetAsyncKeyState), the creation of files named 'keylogger.dat' or 'keylogger', and files created in AppData with a .dat extension by unauthorized processes. It includes exclusions for common legitimate system and application processes to minimize noise.
Detects malicious npm package behavior where a package uses 'npm pack' and associated script files (e.g., sync-peer.cjs) to download and overwrite its own installed files. This technique is often used in software supply chain attacks to bypass static analysis of the original package tarball by fetching a second, malicious version at runtime.
Detects the creation of executable files within the C:\ProgramData\ directory initiated by common command-line interpreters (cmd.exe, powershell.exe, wscript.exe, svchost.exe). This pattern is often indicative of the SystemBC backdoor or similar malware attempting to drop its executable payload in a non-standard, persistent location to evade initial detection.
Page 138 of 217