Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects screen capture behavior associated with the Turla group's STOCKSTAY/STOCKTRADER malware. The rule identifies a process running from the '%LOCALAPPDATA%/Programs/SMN/' directory generating multiple image files (png, bmp, jpg, jpeg), which is consistent with the malware's functionality of capturing and encoding screenshots for exfiltration.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects a web browser saving an executable to disk immediately after the user conducts a search engine query for W2 tax forms, indicating SEO poisoning or malvertising.
Detects the Matanbuchus loader downloading and writing the AstarionRAT executable payload to disk in the AppData directory, specifically when initiated by rundll32.exe.
Identifies scripts or commands iterating through logical drives specifically searching for sensitive file extensions (.kdbx, .pdf, .docx, .xlsx, .txt) and then creating a text file, indicating potential data staging prior to exfiltration.
Correlates the initial Fake Tech Support lure with the dropping of the secondary Havoc .exe or .dll payload into C:\Users\Public or %AppData%. This rule detects the creation of executable or DLL files in common public or user application data directories, specifically within 'C:\Users\Public' or 'C:\Users\<username>\AppData\Local', and correlates this file creation with a process that has '--kiosk' in its command line, which is often associated with browser-based lures.
This rule detects the behavior of a temporary executable making a network connection and then deleting itself shortly afterwards. It specifically looks for file creation and deletion events of executables within temporary directories (e.g., \temp or \appdata\local\temp) where the context process is a command-line interpreter or another executable. The rule's logic is designed to identify specific malware structures like SessionGate, Remus, or AnimateClipper rather than generic executable names.
This rule detects persistence mechanisms associated with the Turla STOCKSTAY backdoor. It monitors for the creation or modification of Registry Run keys, the execution of msiexec for suspicious MSI package installations (DiplomacyEduAI.msi, Copia.msi), and the presence of known STOCKSTAY component executables (e.g., MicrosoftUpdateOneDrive.exe, SMEditor.exe) in the %LOCALAPPDATA%/Programs/SMN/ directory.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
Detects the creation or modification of a web shell named 'help.php' within REDCap application directories, a known persistence mechanism used by UNC6508. This rule specifically looks for file creation, modification, or renaming events for 'help.php' in paths containing 'redcap'.
Detects common anti-forensic staging patterns used by IoT botnets such as TerraBot, r00ts3c, and RondoDox. The rule identifies processes that stage payloads in the /tmp directory, set world-writable execution permissions (chmod 777), and immediately delete artifacts following execution to hinder forensic analysis.
Detects the creation or modification of JavaScript or HTML files that contain code indicative of WebGL cloaking. This includes scripts that combine WebGL renderer collection, timezone detection, touch support checks, and console/devtools tampering. The rule looks for specific keywords related to these techniques within the file content or process command line, suggesting an attempt to fingerprint or obfuscate browser characteristics.
Detects bulk file copies to removable drives for physical data exfiltration
This rule detects suspicious executable or DLL file creations in common temporary or user-writable directories shortly after a Microsoft Defender related process (MsMpEng, Nissrv, Werfault, Services) terminates unexpectedly. The rule focuses on the causality chain to link the Defender crash with the subsequent file placement, suggesting an attempt to bypass or disable security software before deploying malicious payloads.
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
Detects file encryption activity associated with Prinz Eugen ransomware by monitoring for newly created files with the '.prinzeugen' extension and a significant total file size increase within a short period.
Detects a web server process creating at least two different backdoored WooCommerce files within a 5-minute window. This behavior is indicative of a supply chain compromise targeting ShapedPlugin, where malicious plugins distribute backdoored files.
Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.
This rule detects the dropping of a 24-character hexadecimal JavaScript payload followed by the creation of a '.pkg_history' or '.pkg_logs' marker file within a one-minute timeframe. This behavior is indicative of the Mastra NPM supply chain compromise.
Detects a .zip or .rar archive being dropped in a downloads folder, followed immediately (within 10 minutes) by the execution of a suspicious installer executable from that same path. The installer executable names are indicative of fake AI-related software (e.g., deepseek, gpt, kimi). This pattern suggests a social engineering attack where users are tricked into downloading and executing malicious software disguised as legitimate AI applications.
This rule detects the creation or modification of at least 10 files within an hour that have the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware encrypting files using ChaCha20.
Page 152 of 217