Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.
Detects activity associated with VILE ransomware where it modifies files within the Chrome extension locale directory (specifically for the extension nmmhkkegccagdldgiimedpiccmgmieda) by appending the .vile extension, indicating potential file encryption or tampering for impact.
Detects potential SNOWLIGHT dropper behavior where a process associated with Windows Update (wusvc.exe) is observed alongside environment naming conventions indicative of analysis sandboxes (e.g., 'malware', 'sandbox', 'virus', 'sample'). This combination of process naming and environment characterization suggests evasion or anti-analysis techniques typical of malware droppers.
Detects suspicious unsigned processes that load user32.dll (often for API hooking) while concurrently writing data to files in temporary or application data directories (consistent with keylogging dump patterns). This rule targets non-system binaries originating from user-writable paths that exhibit combined module loading and file output behaviors typical of keylogger malware like TrymeLocker.
Detects behavior indicative of Pay2Key ransomware, specifically the renaming of files with a '.3396bw_p2k' extension, the creation of 'HowToRestoreFiles.txt' ransom notes by Everything.exe, or file rename activity initiated by Everything.exe from a 7Zip SFX temporary directory.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects PowerShell spawning csc.exe to dynamically compile the custom launcher (uds.exe) natively on the host.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects the initial Go-compiled dropper binary extracting and writing an intermediate .vbs file to the Temp folder. The VBScript file name will consist of 10 or more lowercase alphabetic characters.
Detects evidence of exploitation targeting a use-after-free vulnerability in the c-ares DNS library. The rule monitors for three primary indicators: abnormal child process creation (e.g., cmd.exe or calc.exe) originating from applications known to link against c-ares (like node.exe or curl.exe), the presence of specific proof-of-concept (PoC) artifact files on disk, and the direct execution of identified c-ares exploitation harness binaries or scripts.
This rule detects outbound network requests to the Filemail API (specifically '2117.filemail.com/api/file/get') followed by the dropping of a ZIP archive within a 10-minute window by the same initiating process on the same device. This behavior is indicative of the 'Screening Serpens' threat activity, where adversaries use legitimate web services like Filemail to deliver malicious payloads.
Detects local privilege escalation attempts targeting the SystemInformer service (phsvc.exe) IPC mechanism. The rule identifies suspicious process activity, including the side-loading of a PoC DLL into rundll32.exe, the spawning of child processes from the SystemInformer service context, and the presence of PoC artifacts in system paths, which are used to gain SYSTEM-level execution.
Detects when a non-Discord process creates or modifies both 'index.js' and 'package.json' within a Discord desktop core module directory. This file pair is critical for Electron module loading and is often targeted by malware like VVS Stealer to establish persistent session interception.
Detects a process creating both the PyArmor runtime module and Python 3.11 runtime library in user-writable locations. The component pairing is consistent with execution staging for the PyInstaller-packaged, PyArmor-protected VVS sample.
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
Detects files dropped into the %ProgramData%\USOShared\Logs\User path, a location used by PRISMEX to hide its proxy DLL.
Detects the creation of PwCWSP64.dll, a malicious network or Winsock Service Provider component dropped by Makop ransomware.
Correlates suspicious Temp directory creation with immediate wallpaper registry modifications, a common pattern for Makop ransom notes.
Identifies the creation of ransom notes or markers containing the victim ID bracket format used by Makop.
Detects WinRAR.exe writing HTA files into the Windows Startup directory via traversal sequences in weaponized archives.
Page 151 of 217