Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of files with suspicious names (e.g., .xlamb, lambsys) in the /var/tmp directory, initiated by common command-line interpreters or network transfer utilities. This behavior is often indicative of malware deployment or staging in a Linux environment.
Detects the creation of a file named 'NTDS.zip', which is a common naming convention used by adversaries when compressing the Active Directory database (NTDS.dit) for staging and subsequent exfiltration.
This rule detects the creation or modification of generic executable files (e.g., 'me.exe', 'update.exe') within the Hola installation directory. It specifically looks for executables whose names match common updater or service patterns and whose process command line includes 'hola', 'update', or 'installer'. This activity could indicate a compromised delivery pipeline or supply chain attack, as observed with the Hola browser.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
This rule detects the creation of shortcut (.lnk) files within the Windows Startup folder initiated by potentially suspicious processes such as WinRAR, unrar, or PowerShell. This behavior is indicative of an attempt to achieve persistence by ensuring the execution of a malicious file upon user login.
Detects the creation of a randomly named .ocx file in temporary directories (AppData\Local\Temp or Windows\Temp) followed by its loading by a process. This behavior is indicative of OXLOADER malware staging shellcode, where 'dui70.dll' is often copied and renamed to a .ocx file. Exclusions are in place for common legitimate processes like msiexec.exe and regsvr32.exe.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects StealC malware injecting into suspended chrome.exe or msedge.exe processes via APC injection to bypass Chromium App-Bound Encryption. The detection is correlated with the creation or modification of an IPC output file in C:\ProgramData\ with a specific naming convention (<HWID>.txt).
Detects a high number of office, PDF, text, and archive files created or renamed in the Downloads or AppData Roaming folders by a single process within a fifteen-minute window. The detection is triggered if either 25 or more files are created/renamed, or if the total size of these files exceeds 500 MB.
Detects file creation or process execution occurring from a folder named 'GentlemenCollection', the known staging directory for Gentlemen RaaS EDR killers prior to ransomware encryption.
Detects attempts to restore or extract files containing path traversal characters ('../' or '..\') commonly associated with the ZipSlip vulnerability. This technique was utilized in Operation Escaneo (via the mkzip34.py tool) to deploy webshells automatically upon legitimate archive restoration. The rule specifically looks for file creation or modification events where the initiating process is a common archive extraction tool (unzip, tar) or a Java application server (java, tomcat), the file extension is for a Java web application (.jsp, .jspx), and the resulting folder path contains path traversal sequences.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
This rule detects two common persistence techniques: the modification of Windows Registry Run keys with paths referencing temporary or application data directories, and the creation of autorun.inf files on removable or non-system drives to facilitate potential code execution upon media insertion.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
Detects PowerShell running Profile.ps1 decrypting the payload into RuntimeBroker_update.exe. This rule specifically looks for the execution of 'powershell.exe' with 'Profile.ps1' in its command line, followed by the creation of 'RuntimeBroker_update.exe' by that PowerShell process.
Detects the creation or loading of a driver named Havoc.sys in a temporary directory, or the loading of a known vulnerable Huawei audio driver (HWAuidoOs2Ec.sys) identified by its SHA256 hash. This activity is indicative of the Havoc Process Terminator BYOVD tool, often used in recent campaigns to blind EDR solutions.
Page 148 of 217