Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,459
11,842
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects an executable creating a copy of itself in the current user's Startup folder by comparing the target name or hash with the initiating process. This method is often used by malware to establish persistence and regain execution when the user signs in.
Detects files or directories created beneath the PSEMHUB environment metadata transactions staging path, which could indicate data staging or server compromise. This rule specifically looks for file creation, modification, or renaming events within paths containing 'PSEMHUB.war' and '/envmetadata/transactions/' or '\envmetadata\transactions\'.
Identifies self-extracting archives (SFX) natively dropping the initial VBS payload into temporary paths.
Detects the creation of 'lsass.dmp' files outside of standard Windows Error Reporting (WER) or CrashDumps paths. This activity can indicate an attempt to dump LSASS memory for credential access.
Detects creation of Remcos RAT keylogger output file AppData\Roaming\DT\logs.dat by a non-browser process or a browser process indicating process hollowing
Detects HKCU/HKLM Run key write whose registry_value_data points to an executable under AppData\Roaming, correlated with a FILE_CREATION of that executable on the same host within 5 minutes. Consistent with the TuglaInsaatci steganographic loader dropping a randomly-named copy of itself (e.g. dEprjIuLKcEd.exe) to AppData\Roaming and registering it for autorun.
Detects the creation of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
Identifies the threat actor dropping web shell files (.aspx, .php, .jsp) directly into the BeyondTrust/Bomgar application directories to establish persistent web-based access.
This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.
Detects the secondary PowerShell stage explicitly downloading and writing the client32.exe NetSupport Manager RAT binary to disk. This rule identifies instances where a file named 'client32.exe' is created on a device, and the process responsible for this file creation is PowerShell.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
Detects the creation or modification of a file named 'logs.dat' within the 'AppData\Roaming\DT\' directory by processes other than 'explorer.exe' or 'system'. This pattern is often indicative of malware or unwanted programs attempting to establish persistence or store data in a hidden or less scrutinized location.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects the creation of hidden Python virtual environments (.venv, .pip) in user directories used to cleanly execute OpenClaw and GhostSocks without system dependencies. This rule specifically looks for 'python.exe' executing with the '-m venv' argument followed by a hidden directory name (starting with a dot) and joins this with file events indicating a folder creation.
This rule detects the execution of a user-mode EDR Killer executable from common temporary or public directories (Temp or Public) immediately preceding the creation of a known ransomware or payload file (executable, MSI, batch, or PowerShell script). The detection logic looks for process command lines containing keywords like '-kill', '-bypass', or '-edr' for the EDR Killer, followed by a file creation event within a 5-minute window on the same device.
Correlates the dropping of an rclone.conf file with the immediate execution of the Rclone utility, indicating potential data exfiltration activity.
Detects compressed or packed executable payloads used to evade detection
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Page 143 of 217