Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters.
Detects a multi-stage attack pattern involving the creation of JavaScript or XML files in a specific public user directory, followed by their execution via wscript.exe or cscript.exe, and subsequently, the spawning of curl.exe by these script hosts to download additional content. This sequence is indicative of malware staging and execution, often used for initial access or further payload delivery.
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
Detects attempts to copy sensitive configuration or credential files (e.g., .ssh, .zshrc, .bash_history, .gitconfig, .kube, .aws) to a suspicious temporary directory '/tmp/sync' on macOS systems using common shell commands like 'cp', 'bash', 'zsh', or 'sh'. This activity could indicate an adversary staging data for exfiltration or further malicious use.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Detects PowerShell downloading a packed loader DLL and writing it directly to the C:\Users\Public directory. This rule specifically looks for file creation events where the file path is within 'C:\Users\Public', the file name ends with '.dll', and the initiating process is 'powershell.exe'.
Detects the creation of specific folders in AppData used to host the unpacked malicious extension locally, specifically looking for 'manifest.json' within an AppData\Local path, in conjunction with the execution of '7za.exe' (7-Zip archiver). This combination indicates the potential unpacking and setup of a malicious browser extension for sideloading, as observed in UnregStealer campaigns.
This rule detects the loading of a machine learning model (e.g., Pickle, PyTorch, or Hugging Face model files) via Python, immediately followed by the creation of a Windows Executable (PE) or Shared Object (.so) file on disk by the same initiating process. This behavior is indicative of an embedded stage-2 loader within a malicious model file, often seen in backdoored Large Language Models (LLMs). The time correlation between the model loading and the file drop is set to 45 seconds to identify immediate post-load execution.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
Detects automated scripts generating large volumes of text or markdown documents in corporate sync folders (OneDrive/SharePoint) designed to flood the AI indexer with poisoned recommendations.
This rule identifies newly created PHP files within specific WordPress plugin folders ("woocommerce-subscription" or "woocommerce-notification") that have a rare SHA256 hash count (less than 5 occurrences in the enterprise). This behavior is indicative of web shells or backdoored plugin files, potentially introduced via a supply chain compromise.
Tracks the process tree where a Fake AI installer (deepseek*, ProFluxeFlowAi*, etc.) executes and writes pythonw.exe to disk. This activity is indicative of social engineering attacks leveraging the popularity of AI tools to deliver malicious Python-based loaders.
This rule detects unauthorized processes attempting to create, modify, rename, or delete the 'Login Data' SQLite database files used by Google Chrome and Microsoft Edge to store saved credentials. By excluding legitimate browser processes and updates, the rule identifies potential credential theft attempts by infostealer malware or unauthorized actor tools.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Detects the creation of AsyncRAT's decrypted PowerShell staging script named with a specific Cache_{GUID}.ps1 format in AppData. This rule specifically looks for file creation events where the filename matches the regex pattern for 'Cache_GUID.ps1', indicating the dropping of a PowerShell script by AsyncRAT.
Detects the creation of common ransomware note file names with suspicious extensions.
Detects malicious ClickOnce application manifests for proxy code execution
Detects the usage of curl and tar commands in rapid succession to download and extract files. This behavior is characteristic of EtherRAT's Node.js staging process, which bypasses pre-installed dependencies.
Detects when 'SystemSettings.exe' is copied from its legitimate location to common staging directories like ProgramData, AppData, Temp, or Public. This activity is often observed in campaigns like StrikeShark as an early indicator before sideloading, providing an opportunity for earlier detection.
Page 156 of 217