Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,459
11,842
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
Detects the LegionLoader malware execution chain, specifically identifying the side-loading of a malicious 7z.dll file placed in user-writable directories (e.g., AppData, Temp) instead of legitimate 7-Zip installation paths. This rule correlates the file creation event with the suspicious behavior of msiexec.exe launching cmd.exe, a characteristic pattern of the LegionLoader LOLBin execution flow.
This rule detects potential ransomware activity by monitoring for the creation, modification, or renaming of files with the '.prinzeugen' extension. This extension is commonly associated with specific ransomware families. The rule triggers if 10 or more such files are observed within a one-hour window on a single device, indicating a bulk encryption event.
This rule detects the creation of a 'mcp.json' configuration file within an '.amazonq' directory shortly after version control system operations such as 'git clone', 'git pull', 'npm install', or 'pip install'. This activity may indicate an attempt to configure or persist unauthorized developer tools or malicious assistant configurations within a development environment.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects modifications or creations of manifest.json files within specific directories associated with a browser extension. This behavior is often indicative of the installation or tampering of browser extensions by malicious actors to establish persistence, perform credential theft, or execute unauthorized actions within the browser context.
Detects the presence and execution of 'HFY.exe', a trojanized telecom utility associated with BeepRAT malware. The rule flags file creation or process execution events involving this specific filename, which often indicates the reconnaissance phase where the malware generates a hardware identifier (HWID) for C2 registration.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects the execution of HFY.exe, a known component of the BeepRAT malware family, along with the presence of its associated sideloaded or dependency DLL files (e.g., data.dll, SQLite.Interop.dll). The rule monitors both process creation events and file system artifacts indicative of the malware's deployment.
This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
This rule detects the creation of executable or script files (e.g., .exe, .dll, .ps1, .bat, .cmd) by wscript.exe or cscript.exe within common user-writable directories such as AppData, Temp, Downloads, Documents, or Music. This activity can be indicative of malicious VBScript execution attempting to drop and execute secondary payloads, often associated with phishing campaigns.
This rule monitors for the presence of a specific malicious browser extension (by identifier) on the file system and simultaneously tracks outbound network connections to a known typosquatted domain ('perplexity-ai.online'). It alerts on the potential presence of an adversary-controlled browser plugin or user navigation to a malicious domain often used in phishing or credential harvesting campaigns.
Detects the use of the Tiny C Compiler (TCC) to compile or execute shellcode associated with BeepRAT malware. The rule monitors for characteristic TCC command line arguments ('-nostdlib', '-run') and specific file names ('temp.bin', 'config.ini.c') within the TCC deployment path that are indicative of staging and executing malicious code while attempting to bypass defensive mechanisms like AMSI, ETW, and WLDP.
Detects the presence of a known malicious Chrome extension (ID: flkebkiofojicogddingbdmcmkpbplcd) or its associated files (e.g., rules.json, background.js) within browser extension storage directories on managed Windows endpoints. This rule monitors for file activity related to browser extensions that may have been deployed via malicious means to steal credentials or establish persistence.
This rule detects the creation of a specific file named 'linux-process-env.json' on Linux endpoints. The creation of environment-related configuration files in unexpected locations or by unauthorized processes may indicate reconnaissance, staging of malicious configuration, or post-exploitation activities by an adversary.
This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.
Detects the installation of a malicious Chrome extension (identified by its extension ID) that abuses declarativeNetRequest permissions to intercept and redirect user search queries through the 'perplexity-ai.online' domain. The detection correlates the creation of the extension's directory on disk with a high volume of network connections from the browser to the malicious intermediary domain.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Detects potential BeepRAT malware activity characterized by a process executing from a non-standard directory, writing suspicious artifacts like images or encrypted files to the AppData folder, and initiating frequent outbound network connections typical of command-and-control beaconing.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Page 142 of 217