Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
This rule detects the creation of 'system.dll' or 'shfolder.dll' files within Windows or AppData temporary directories. These specific filenames are frequently associated with DLL sideloading or search order hijacking techniques where malicious DLLs are masqueraded or placed in writable user-space folders for execution by legitimate processes.
Detects the creation of known webshell filenames within web-accessible directories (such as wwwroot or CFIDE) by ColdFusion or IIS worker processes. This behavior is indicative of an adversary re-establishing persistence or re-compromising a web server through unauthorized file drops after initial exploitation.
Detects the creation of a suspicious file (script or executable) within common web directories (inetpub or wwwroot) followed by an attempt to timestomp that file using common tools like PowerShell, Rundll32, or dedicated timestomping binaries within a 30-minute window. This behavior is indicative of an attacker attempting to establish persistence via a web shell while concealing the activity by modifying file timestamps.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule identifies the MeshCentral agent by process image name and common deployment paths or by its execution via common shell/download utilities. It also looks for the creation of the ransom note file 'README-IF-YOU-SEE-THIS-YOU-VE-BEEN-HACKED.TXT'.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects cleanup of captured frames, QR images, overlay resources, or decrypted modules after a banking fraud session, specifically targeting files with names containing 'screen', 'frame', 'overlay', 'qr', 'module', or 'stage' and extensions like '.png', '.jpg', '.bmp', '.dll', '.dat', '.bin' within common temporary or application data directories. The activity is attributed to processes with 'banana', 'client', 'update', or 'service' in their base file name.
Detects a banking trojan creating command, task, response, or queue files in an application-data directory for asynchronous remote control. The rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file name contains keywords like 'command', 'task', 'queue', 'response', or 'job' with extensions like json, dat, bin, or txt. Additionally, it checks if the file path is within an AppData or ProgramData directory and if the context process is named 'banana', 'client', 'update', or 'service' with an .exe extension.
This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.
Detects a game-related process creating ZIP, 7z, or encrypted data containers in an inconspicuous AppData subdirectory. This behavior is indicative of data staging prior to exfiltration, often seen in supply chain attacks or targeted espionage.
Detects when a non-root user modifies, creates, or renames files within common cron directories or the main crontab file on Linux systems. This activity can indicate an attempt to establish persistence or schedule malicious tasks.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
Detects Pony malware dropping a self-deletion batch script into %TEMP% via ShellExecuteA, then executing it with cmd.exe. The batch loops using 'if exist %1 goto' until the loader file lock is released, deletes the loader, then deletes itself with 'del %0'. Correlates .bat file creation in TEMP with subsequent cmd.exe execution of that same file on the same device.
High fidelity detection combining the specific firefx-* staging directory pattern with the .vmxx shellcode file extensions, indicative of Operation XENOFISCAL activity. This rule identifies the creation or modification of files with '.vmxx' extension or specific filenames ('ayui.vmxx', 'ayhui.vmxx') within a suspicious 'C:\Users\Public\firefx-[a-f0-9]+-[0-9]+\' directory pattern, which is known to be used by the SideCopy threat group.
Detects the presence or installation of known malicious Adblock for YouTube browser extensions. These extensions are flagged for utilizing overly broad host permissions (e.g., <all_urls>) in conjunction with webRequest and scripting capabilities, which facilitates cross-site data collection, potential session hijacking, and the injection of malicious remote scripts.
Detects malicious GitHub Actions workflow activity characteristic of the Miasma worm. The rule monitors for the creation or update of workflows named 'Dependabot Updates' (masquerading), which utilize OIDC token write permissions and execute scripts using 'bun run _index.js', often on suspicious snapshot branches.
Detects various methods of establishing persistence on Linux systems by abusing dynamic linker configuration (/etc/ld.so.preload), modifying shell startup profiles (.bashrc, .profile) to include malicious environment variables (LD_PRELOAD/LD_LIBRARY_PATH), or directly launching processes with these hijacked variables pointing to suspicious locations such as /tmp, /dev/shm, or /var/tmp.
Detects modifications to .git/hooks/pre-commit files across developer workspaces, which is a primary persistence mechanism ensuring payload re-execution on git commits.
Detects the creation of specific files ('Mixed Reality.exe' or 'nvdaHelperRemote.dll') within the 'C:\Program Files\Windows Media Player\' directory. This activity is a known technique used by the threat actor group associated with Operation DragonReturn (Silver Fox) to stage DLL sideloading, facilitating the persistence of malware such as DcRAT or XenoRAT.
Page 140 of 217