Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of files within the Windows Startup directory. Adversaries use this folder to achieve persistence by ensuring that malicious files or shortcuts are executed automatically when a user logs in.
Detects the creation and subsequent deletion or modification of 'wipefile.tmp' or similarly named temporary wipe artifacts, which are used by the Gentlemen ransomware during its cleanup phase. This rule specifically looks for file events (creation, deletion, modification) related to this filename.
Detects high volumes of file operations (creation, rename, or modification) where files are given extensions typically associated with ransomware (e.g., .locked, .encrypted). The rule aggregates activity by process and endpoint and triggers an alert when the number of such operations exceeds a defined threshold, while excluding known legitimate backup and security software.
Detects file creations (images), image loads, and process execution activity originating from or related to the 'SCef.WindowsAdapter' directory. This directory is often associated with specific third-party application behaviors and should be monitored for potential anomalous execution or staging of suspicious files.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects the creation of files with specific, non-standard extensions (e.g., .a9oc, .lpxQ, .lpXD) within the C:\ProgramData directory by scripting engines like wscript.exe, cscript.exe, or powershell.exe. This activity is associated with the Kimsuky threat group, who use these scripts as loaders to drop NUKESPED DLL payloads.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
This rule detects a suspicious sequence of file creation events occurring within a 60-second window in a temporary directory. The pattern involves the creation of a .lnk file, a .pdf file, and an executable (.exe or .dll). This behavior is characteristic of malicious activity where a shortcut file is used to lure a user into opening a document that subsequently executes a malicious payload.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
Detects the creation or modification of the VbaProject.OTM file, which stores VBA macros for Microsoft Outlook, by a process other than the Outlook application (OUTLOOK.EXE). This is a common technique used to deploy malicious macros for persistence or code execution within the Outlook environment.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects potential WMI persistence mechanisms by monitoring the execution of 'mofcomp.exe' by non-Microsoft signed binaries, the creation of MOF files in suspicious user-writable directories (Temp, AppData, etc.), and the suspicious execution of 'scrcons.exe', which is the WMI permanent event consumer process.
Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.
Detects the AMOS infostealer staging collected system data by using the macOS ditto utility to compress information into a hidden .hipr directory. The rule identifies the execution of ditto with .hipr in the command line in conjunction with the creation of User_Name.txt and System_Information.txt within that same directory.
Detects the OXLOADER malware dropping a malicious copy of dui70.dll renamed as a random .ocx file into the user's temporary directory. The rule identifies subsequent loading of this dropped file via LoadLibraryA, which is indicative of module stomping techniques where malicious code in an added .xtext section is executed within the context of a legitimate system component.
Detects the creation or modification of a file named 'dui70.dll' (or variants if renamed) within non-standard, user-writable directories such as AppData or Temp. This behavior is indicative of malware, specifically the OXLOADER payload, preparing for module-stomping by placing a malicious DLL copy outside legitimate Windows System32 or SysWOW64 paths.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Detects suspicious activity related to the Print Spooler service (spoolsv.exe), specifically focusing on the spawning of known command-line interpreters (cmd.exe, powershell.exe, rundll32.exe) by spoolsv.exe, as well as the creation or modification of DLL files within the system print spool drivers directory by processes other than spoolsv.exe. This activity is often associated with privilege escalation and persistence techniques involving print spooler service abuse.
Page 147 of 217