Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,459
11,842
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects activities associated with c-ares TCP Use-After-Free (UAF) exploitation, specifically identifying execution of known Proof-of-Concept binaries, the creation of exploitation proof marker files, and suspicious parent-child process relationships where network-facing services or common interpreters (e.g., node, curl, python) spawn unexpected calculator or shell processes indicative of RCE payloads.
Detects potentially malicious activity originating from or related to the OpenVPN Connect client. This includes the spawning of suspicious child processes (command interpreters and utilities), the creation of a known PoC-related marker file, and modifications to the AutoConfigURL registry value, which can be used to inject PAC (Proxy Auto-Configuration) URLs.
This rule detects the presence or installation of a specific malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). This extension masquerades as a 'Search for perplexity ai' utility but is designed to hijack browser search queries by redirecting them to a typosquatted domain ('perplexity-ai.online') using declarativeNetRequest rules.
Detects the installation of a malicious browser extension that impersonates the legitimate Perplexity AI service. The extension leverages a typosquatted domain ('perplexity-ai.online') and a specific extension ID to facilitate search hijacking and keystroke collection on the victim host.
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
This rule detects when a non-Outlook process running as SYSTEM accesses or creates PST or OST mailbox data files. The logic specifically excludes legitimate Outlook, searchindexer, or searchprotocolhost activity to focus on suspicious mailbox collection sequences.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
This rule detects suspicious staging activity by monitoring for the creation of 'editor.dat' files in sensitive directories like C:\Users\Public or C:\Windows\Tasks, or the rapid accumulation of multiple executable files (.exe, .dll, .cpl) within the C:\Users\Public directory, which is a common technique used by attackers to stage tools before execution or lateral movement.
This rule detects the creation, execution, or presence of specific file names and command-line arguments associated with local RCE research, proof-of-concept exploits, and server-side harnesses, specifically identifying artifacts prefixed with 'libpwn_'.
This rule detects the creation of executable or script files within common user-writable directories (Downloads, Desktop, Documents, Temp) when the file writer process is identified as '7z.exe'. This behavior is common in download-and-execute attack chains where an archive is extracted to place malicious payloads on the system.
Detects the creation or execution of files associated with the Floci remote code execution (RCE) proof-of-concept tool. It monitors for specific filenames or command-line patterns indicative of this exploit, particularly when spawned from Java-based applications or involving shell command execution.
Detects evidence of a local privilege escalation attempt targeting the SystemInformer (formerly Process Hacker) phsvc service. The detection identifies the loading of a known proof-of-concept DLL into rundll32.exe, the creation of specific indicator files on disk, or rundll32.exe executing command-line payloads associated with the exploit.
Identifies multiple directory junctions being created in a short time frame by the same user or process. This behavior indicates the potential setup of a GhostTree binary tree-like structure, which creates recursive loops to evade EDR and folder scans.
This rule detects the presence of known Android Remote Access Trojan (RAT) APK files on Windows endpoints, or the use of Android Debug Bridge (adb.exe) to install such APKs. It monitors file creation/modification events for specific malicious filenames and process execution patterns involving 'adb install' commands, as well as suspicious script interpreters creating APK files in user-writable directories.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
Detects artifacts and execution patterns associated with the Grandoreiro banking trojan. This includes the identification of known Embarcadero Delphi DLLs (mingwm10.dll, libwebp.dll, libffi-6.dll, libpng15.dll) being dropped into or loaded from AppData local directories, as well as wscript.exe or cscript.exe spawning suspicious executables from the same path, which is consistent with its VBS dropper chain.
Detects the creation or modification of shortcut (.lnk) files within the Windows Startup folder by known archive utilities (e.g., WinRAR, 7-Zip). This behavior is highly suspicious as these tools are commonly leveraged by adversaries to drop malicious payloads or persistence mechanisms into the user's startup directory.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
This rule detects potentially malicious activity involving the WinRAR utility. It monitors for WinRAR creating files in Windows Startup folders, dropping files in specific ProgramData subdirectories often associated with staging malicious payloads, and spawning suspicious child processes such as command shells, scripting engines, or HTML applications.
Detects WinRAR (winrar.exe) creating shortcut (.lnk) files within the Windows Startup directory or staging suspicious files within specific ProgramData directories. This behavior is indicative of potential persistence mechanisms or malicious staging of secondary payloads by WinRAR.
Page 145 of 217