Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects potential supply chain attacks where a Node.js process (npm, npx, node) triggers an unauthorized shell, scripting interpreter, or network utility (such as curl, wget, powershell, or bash) to execute commands. This behavior, when followed by file creation in temporary directories (e.g., /tmp, AppData\Local\Temp) within a 5-minute window, is indicative of malicious npm postinstall hooks, commonly seen in supply chain compromise campaigns.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Detects the steganographic payload extraction chain associated with the TuglaInsaatci .NET loader. The rule monitors for the sequential creation of 'payload.bin' (reconstructed from bitmap data) followed by the creation of 'Optimax.dll' on the same host, which is characteristic of the FortiBleed campaign's loader-as-a-service delivery methodology.
Detects the OXLOADER malware dropping a renamed copy of dui70.dll with a malicious RWX .xtext section into the user's Temp folder, followed by the loader process reading mpr.dll, which is a known behavior related to its sandbox check and API resolution execution chain.
Detects execution of potential keylogging software from suspicious paths like AppData or Temp, followed by the creation of a keylogger log file artifact in the specific AppData\Roaming\DT\ directory.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
This rule detects attempts to create symbolic links, junctions, or reparse points that target Microsoft Defender directories such as quarantine, platform, or scan paths. Adversaries may use these techniques to interfere with security tools, evade detection, or manipulate how Defender processes files.
Detects the VSPMsg print processor path and DLL name, which is associated with the SprySocks malware for persistence on Windows systems. The rule looks for specific strings related to the DLL name, print processor path, and common installation directories used by this malware.
Identifies the clipper writing wallet seed phrases.
Gamaredon hides directories and replaces them with LNK files on removable media.
Detects removal and replacement of Chrome.app on macOS to bypass Manifest V3.
Detects GreenBlood ransomware activity by monitoring for the creation of its specific ransom note file ('READ_ME_TO_RECOVER_FILES.txt') and the renaming of files to its characteristic encrypted extensions ('.tgbg' or '.bak'). The rule aggregates these events by device and process, triggering an alert if a ransom note is dropped or if more than 5 files are renamed with the ransomware's extensions.
Correlates the Komari C2 agent writing secondary executable payloads (.exe, .dll) to disk, indicating lateral tool transfer or stage progression.
Correlates the deployment of the specific Nightspire ransom note (Nightspire_Readme.txt) across multiple directories during the encryption phase, identifying instances where more than 10 such files are created within a minute by the same process on a device.
Detects a deceptive 'Updater' or Adware installer dropping heavily packed, randomized executables into the %TEMP% directory, transitioning from nuisance to active malware. This rule correlates file creation events in the temporary directory with process creation events initiated by common installer/updater filenames.
This rule detects suspicious activity indicative of reflective code loading, often used by adversaries to conceal malicious payloads. It looks for specific strings in script content or PowerShell commands, combined with the creation of a 'payload.bin' file or the loading of 'Optimax.dll'. The rule correlates these events to identify potential in-memory execution of malicious code.
This rule detects the creation or modification of executable files (.exe) within the 'AppData\Roaming' directory, excluding common legitimate application subfolders (Microsoft, Adobe, Mozilla, Skype, Notepad++). The detection is further refined by correlating these file events with processes that have specific version information (FileDescription, OriginalFileName, or ProductName) matching 'TuglaInsaatci' or 'oacY.exe'. This pattern is indicative of potential malware or unwanted applications attempting to establish persistence or execute from user-specific application data folders.
Detects unauthorized access, creation, or modification of sensitive credential and token files (e.g., OAuth tokens, AWS credentials, gcloud tokens) in common user directories like AppData or .config by processes other than established browsers or legitimate cloud CLI tools. This behavior is indicative of credential theft or SaaS pivot attacks.
Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.
Detects macOS Python processes creating zip archives in temporary or 'collected_data' folders, potentially indicating data collection and exfiltration staging. The rule specifically looks for Python processes that have previously accessed sensitive paths like 'login.keychain-db' or performed data collection/compression activities.
Detects an end-user web browser downloading an .rdp (Remote Desktop Protocol) configuration file, a primary lure for Terminal Server phishing.
Page 155 of 217