Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of a 'keylogger.dat' file within the Windows APPDATA Roaming directory. This specific file path is a known artifact generated by Remcos RAT when utilizing its offline keylogger capability, which relies on the SetWindowsHookExA API with the WH_KEYBOARD_LL hook to intercept keystrokes.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
This rule detects an unusual number of file creations or modifications where the filename contains keywords like 'patch', 'update', or 'fix' by a single account within a one-hour window. This could indicate an automated patching process, software deployment, or potentially malicious activity attempting to modify system files under the guise of an update.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
This rule detects when a single process creates or modifies 3 or more JSON files within a folder path containing 'package' within a one-hour window. This could indicate software installation, updates, or potentially malicious activity involving package management or configuration files.
This rule detects a high volume of file creation events (100 or more within an hour) occurring in common development-related directories such as 'node_modules', 'packages', or 'vendor'. This activity can be indicative of legitimate software development processes like dependency installation or project builds. However, it can also signal malicious activity, particularly if observed on systems not typically used for development, or as part of a supply chain compromise where malicious dependencies are being introduced or built.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
This rule detects an unusually high number of file creations (50 or more within an hour) in folders whose paths contain 'source' or 'src'. This activity is grouped by the initiating process and could indicate various activities such as software compilation, deployment, or potentially malicious actions involving rapid file generation in development-related directories.
Detects the presence of file artifacts associated with known keyloggers (keylogger.dat, remcos.log) or files containing 'keylog' within the AppData\Roaming directory, which is a common persistence location for malware.
Detects the presence of Remcos RAT executable files or the creation of screenshot files by non-standard processes, commonly used for remote surveillance.
Detects the LokiBot information stealer establishing persistence via a Windows Run key. The detection looks for registry key modifications under HKCU that follow a specific pattern: the registry value points to an executable located within the %APPDATA% directory inside a short, six-character hexadecimal subdirectory. The rule further validates this behavior by monitoring for key names derived from the C2 infrastructure components, such as IP addresses or specific PHP script names, commonly observed in builder-generated LokiBot samples.
Detects PowerShell expanding a downloaded archive (winPatch.zip) to %TEMP%\winPatch and subsequently launching the update.vbs bootstrapper via wscript.exe, as observed in the abdrizak PostCSS typosquatting campaign distributing a Windows RAT.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.
Detects the execution of known offensive security toolkits commonly used for Active Directory enumeration and exploitation, including Impacket (mini_imp) and BloodHound/SharpHound. The rule monitors for command-line arguments and file creation artifacts associated with these tools.
Detects anomalous activity originating from Oracle database processes, including the spawning of shell commands via DBMS_SCHEDULER, execution of known attacker staging scripts, and the creation of sensitive output files in temporary directories, which are characteristic of database-level remote code execution or exfiltration attempts.
Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.
This rule detects activities related to Operation Escaneo, specifically focusing on the creation, modification, or access to cleartext credential harvesting files (e.g., vpn-passwords.txt) and the execution of associated Python scripts (forti_login2.py, forti_login3.py) used for credential staging and extraction on FortiGate systems.
Detects the creation or modification of a file named 'System.dll' within a subdirectory of the 'C:\Windows\Temp' directory where the writing process is not signed by Microsoft. This behavior is indicative of potential DLL sideloading or masquerading attempts, where an attacker drops a malicious DLL in a writable directory to be loaded by a legitimate process.
Detects the staging and potential execution of Java deserialization payloads associated with the ysoserial CommonCollections5 (CC5) exploit, which leverages the BadAttributeValueExpException gadget chain.
Page 139 of 217