Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects IDE processes creating ZIP archives in temporary directories, which can indicate exfiltration of cryptocurrency wallets. The rule specifically looks for 'Code.exe' (VS Code) or 'cursor.exe' creating '.zip' files in common temporary paths like 'AppData\Local\Temp' or '/tmp/'.
Detects a web server or PHP runtime creating or renaming a PHP file inside a REDCap application directory. INFINITERED trojanised legitimate REDCap components and deployed PHP-based persistence. Production REDCap content should normally be changed through controlled deployment or upgrade activity, so unplanned PHP file creation by the serving process requires investigation.
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
GraphWorm Writes Shell
Cortex XDR
Detects the creation of the distinctive 'beacon_shell_output.txt' file in common temporary directories (Temp, AppData, ProgramData) after command execution, which is indicative of GraphWorm (Webworm) activity.
Detects unauthorized file writes to specific Google Chrome extension directories associated with the VILE ransomware. The rule monitors for file creation or modification events targeting known extension paths or files with the .vile extension suffix, indicating potential persistence or malicious extension installation.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
Detects the creation of files with a '.vile' extension within the Google Chrome extensions directory. This directory path is often used by attackers to install unauthorized or malicious browser extensions to maintain persistence, steal credentials, or pivot within the browser session.
Detects indicators of the VILE ransomware, including execution of known malicious binaries, creation of specific ransomware-related files (artifacts), usage of PowerShell to create shortcuts, and encryption activities in Chrome user directories.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.
Detects an executing ClickOnce package dropping a secondary malicious script directly into the Startup folder.
Detects background JavaScript workers injecting helper files to ensure the extension remains active. This rule specifically looks for the creation of files named 'helper.html', 'dream.html', or 'dream.js' within the Microsoft Edge extension data folder, which is indicative of the SNOWBELT malware's persistence mechanism.
Detects execution of potentially masqueraded processes or the creation of suspicious files, including specific DLLs, configuration files, and activity within VMware folders, often indicative of staging malicious payloads or side-loading attempts.
Detects the creation of an index.html file by a node.exe process. This behavior is indicative of a Node.js web server or application writing or overwriting a web page file, which may be associated with web shells or defacement activities.
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
This rule detects potential web shell activity on Windows IIS servers by monitoring for two suspicious behaviors: the w3wp.exe process spawning shell processes (cmd.exe or powershell.exe) and the creation or modification of .aspx files within common web root directories (\wwwroot\, \inetpub\). These are common indicators of web shell installation and subsequent remote command execution.
Detects the execution sequence associated with TonRAT malware, including the launching of PowerShell from explorer.exe via malicious LNK files (often disguised as photo or image files) and the subsequent execution of a node.exe process from user-writable directories such as AppData or Temp.
Correlates the execution of the injected Vidar payload with the dropping of legitimate sqlite3.dll, nss3.dll, or freebl3.dll, which are required to parse and steal browser databases. This rule specifically looks for these DLLs being created on a device where the initiating process was 'AutoIt3.exe', indicating a potential Vidar stealer infection.
Identifies Storm-1175 abusing legitimate enterprise software deployment tools like PDQ Deploy to push the Medusa encryptor to all domain endpoints simultaneously. The rule correlates process events related to PDQ Deploy with file events indicating the creation of files with a '.medusa' extension, which is characteristic of the Medusa ransomware.
Page 153 of 217