Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
Detects the presence of Windows Media Player or Mixed Reality process executions in conjunction with the creation of a specifically named DLL (nvdaHelperRemote.dll) within the Windows Media Player directory, which is a common indicator of DLL side-loading or hijacking techniques targeting these applications.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
Detects instances where the 'git clone' command is executed, followed by the creation of a configuration file at '.amazonq/mcp.json'. This pattern may indicate the setup or configuration of Amazon Q developer tools on an endpoint, which could be abused for unauthorized access or information gathering if performed by an unauthorized user or process.
Detects indicators of the DcRAT malware associated with Operation DragonReturn. The rule monitors for the creation of the specific DcRAT mutex 'Global\ShitSetupOn26126k', the execution of a malicious process disguised as the Windows Media Player 'Mixed Reality' utility, and the sideloading of the 'nvdaHelperRemote.dll' file within the Windows Media Player directory, which are techniques used for sandbox evasion and persistence.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
Detects activities associated with the exploitation of the Netfilter vulnerability CVE-2023-32233. The rule monitors for the compilation or execution of known exploit binaries (e.g., packet_edit_meme), the use of 'unshare' for namespace-based privilege escalation (gaining CAP_NET_ADMIN), the loading of the 'act_pedit' kernel module, and potential AppArmor bypass attempts via 'aa-exec'.
Detects a non-browser process creating copies of at least three Chromium credential or browsing databases in a temporary, roaming, public, or program-data directory. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Identifies the creation of a LaunchAgent property list masquerading as 'com.google.keystone.agent.plist'. This behavior is associated with the ClickFix campaign, which uses fake macOS utilities to deliver infostealers.
Detects the creation of the .agent shell wrapper file designed to supervise and restart the .mainhelper backdoor process.
Detects the unique XOR decryption routine logic utilizing the actor's embedded Session messenger identifier as the key string. This rule specifically looks for file creation or modification events of '.pth' files, correlated with process command lines containing 'contact [alphanumeric] on session'.
Correlates the creation and immediate deletion of the trin.tar.gz archive handled by the Python temporary-directory context manager.
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
Detects anomalous screen capture activity associated with StealC malware. It identifies when a non-UI process creates a JPEG file within the system temporary directory followed immediately by an outbound network connection from the same process, which is indicative of the malware capturing a screenshot and staging it for exfiltration.
Detects the creation of '.pkg_history' or '.pkg_logs' files in the OS temporary directory by a Node.js process. This behavior is linked to the easy-day-js supply chain dropper, where the '.pkg_logs' file contains XOR-encoded campaign marker bytes.
Detects the creation of a 'protocal.cjs' file within the '~/.config/systemd/nvmconf/' directory. This activity is associated with the 'easy-day-js' supply chain attack, where a malicious Node.js script is established as a persistent user-level systemd service named 'nvmconf'.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects the creation of a specific ransom note file associated with ShinyHunters activity within PeopleSoft web or application server configuration directories.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Detects the creation or modification of a specific log file at AppData\Roaming\DT\logs.dat on Windows systems, a known indicator of behavior associated with the Remcos Remote Access Trojan (RAT) for capturing and storing keystrokes.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
Page 154 of 217