Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects the LegionLoader malware staging its Python-based C2 module named _socket.pyd within non-standard directories in the AppData\Roaming path. This behavior is indicative of a persistence or execution staging mechanism where the malware attempts to hide its components in user-writable directories while avoiding standard Python installation paths.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Detects unauthorized or non-standard processes attempting to create, modify, or access sensitive cloud configuration and credential files, such as AWS credentials, Azure CLI token caches, or GCP application default credentials. This behavior is indicative of potential credential theft or unauthorized access to cloud environment tokens.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects processes creating a high volume of archive files (zip, rar, 7z, etc.) within common user-writable or temporary system directories. This behavior is indicative of data collection and staging activities, often a precursor to exfiltration. The rule filters out trusted Microsoft processes and established backup or synchronization applications to reduce noise.
Detects the creation of executable or script files by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a drive-by download, a malicious attachment being saved, or other forms of initial access where an attacker leverages a user's interaction with these applications to drop malicious payloads.
Detects the creation of temporary files in Windows Temp or SystemTemp directories that match the naming patterns used by the Windows Installer (MSI) service. These files, often starting with 'MSI' or '~DF' and ending in '.tmp' or '.TMP', are typically legitimate installer artifacts, but suspicious patterns or unexpected execution locations may indicate staging of malicious installers.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
Detects the execution of msiexec.exe or batch files from the AppData Roaming directory, as well as msiexec.exe spawning cmd.exe. These behaviors are frequently associated with staging and executing malicious payloads in user-writable directories.
Detects msiexec.exe being launched with installation flags (/i, /quiet, /q) from user-writable directories (AppData, Temp, Downloads), correlated with file creation in AppData\Roaming subdirectories. This pattern is characteristic of the LegionLoader malware, which drops and executes MSI installer packages to facilitate further infection stages.
Detects a suspicious execution chain associated with LegionLoader, where a malicious DLL (e.g., normaliz.dll or 7z.dll) is staged in the AppData\Roaming directory followed by the execution of rundll32.exe spawned by msiexec.exe or cmd.exe to load the staged DLL.
Detects the LegionLoader malware behavior where a password-protected .dat archive is created in the AppData\Roaming directory followed by the execution of 7z.exe or 7za.exe to extract the hidden payload.
Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
Detects the LegionLoader malware execution chain, specifically identifying the side-loading of a malicious 7z.dll file placed in user-writable directories (e.g., AppData, Temp) instead of legitimate 7-Zip installation paths. This rule correlates the file creation event with the suspicious behavior of msiexec.exe launching cmd.exe, a characteristic pattern of the LegionLoader LOLBin execution flow.
Page 141 of 217