Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or modification of APK files in user-accessible download and temporary directories initiated by web browsers or file management applications. This behavior is indicative of potential sideloading of malicious Android applications, often used in malware delivery campaigns.
This rule detects the creation of large files (1MB or greater) with names suggestive of exfiltration or staging (e.g., containing 'exfil', 'stage', 'batch', 'zip', 'archive') in common temporary or public user directories. This behavior can indicate an adversary preparing data for exfiltration.
Detects the creation of specific file names ('oBKhrQLe1CKmO3RhHO', 'logs.txt', 'ExitCode.txt', 'Key10.txt') within the user AppData Local Temp directory, which is indicative of staging or logging activity by potential malware.
Detects host-based activity related to known UAC-0226 campaign artifacts, including specific decoy PDF filenames and malicious LNK file names found in command-line arguments or file system events (FileName, TargetFilename).
Detects the creation or modification of APK files in user-accessible download and temporary directories initiated by web browsers or file management applications. This behavior is indicative of potential sideloading of malicious Android applications, often used in malware delivery campaigns.
Identifies cross-platform binaries (e.g., compiled Node.js or PyInstaller payloads) extracting dependencies into Temp and launching secondary network listeners.
Detects the GIFTEDCROOK malware creating stable per-host identifiers and operational files within the Windows %TEMP% directory. This behavior indicates post-compromise activity, specifically the establishment of a tracking mechanism or local storage for operational logs and data by the malware.
Detects instances where PowerShell or cmd.exe drops an executable file (or extensionless file) into the C:\ProgramData directory, followed by the execution of that same file within a 2-minute window. This behavior is associated with the UAC-0226 campaign (GIFTEDCROOK loader chain) for staging malicious payloads.
Detects when common archiving utilities (WinRAR, 7-Zip) write a .lnk file to the Windows Startup folder. This behavior is indicative of an attacker attempting to establish persistence by creating a startup link to a payload via an archiving tool.
Detects instances where the WinRAR or Unrar process writes a new executable or script file to the Windows Startup folder or ProgramData directory within a 30-second window. This behavior is commonly associated with archive extraction-based persistence or staging of malicious files.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Detects the creation or modification of '.env' files within '.gemini' directories, often found in CI/CD pipelines or developer environments. This activity may indicate an attempt to inject malicious environment variables to hijack the execution flow of the Gemini CLI or related tooling.
Detects the execution or file creation of identified Turla STOCKSTAY malware components, specifically targeting a list of known malicious filenames and installers used by this actor.
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Detects the deployment of the Kazuar backdoor, initiated by the Gamaredon group's PteroPaste loader. The rule monitors for a suspicious file creation event where a PowerShell or rundll32 process writes a DLL to a user-writable directory (AppData/Local or AppData/Roaming), followed immediately by the creation of a scheduled task (using schtasks) designed to trigger the execution of the dropped DLL via system binaries such as regsvr32, rundll32, or mshta.
Detects the creation or modification of potentially malicious files such as autorun.inf or scripts (.lnk, .vbs, .hta, .bat, .cmd, .ps1) on removable or network drive letter paths (D-Z). This activity is indicative of attempts to facilitate malware execution via removable media, bypassing standard system binaries by excluding Microsoft-signed processes.
This rule detects suspicious activity on Linux endpoints related to the execution of files named 'isp.sh' or 'lambsys', as well as potential file downloads from a known malicious IP address. It monitors process creations and file creations involving these specific artifacts, as well as common attack patterns such as piping web-downloaded content directly to a shell.
Page 146 of 217