Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of various payload and configuration files (VBS, BAT, AHK, PS1, or files containing 'Subtitles') inside the 'Microsoft.WindowsSoundDiagnostics' directory, which is a known technique used by malware like AsyncRAT to evade detection.
Detects the creation of multiple ransom notes (HTML, TXT, or HTA files with specific keywords) across several distinct directories, indicative of MedusaLocker ransomware activity.
Detects a high number of office, PDF, text, and archive files created in Downloads or AppData Roaming by one process within fifteen minutes. This behavior is indicative of data staging prior to exfiltration.
Detects command-line execution of 'cmd.exe' with specific arguments indicative of WMIExec reconnaissance, where the output of 'whoami' is redirected to a file within the '\Windows\Temp\' directory. This is a classic indicator associated with the Impacket toolkit's WMIExec functionality.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Detects a script process creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Udm Ghost Dynamic Js
YARA-L
Targets JavaScript containing atob decoding, dynamic appendChild, and one-time localStorage keys. The UDM rule retains principal and target context for correlation.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Detects the staging of operational executables (like FRP, proxy tools, secrets dumpers, or scanners) within web application administration directories or repository checkouts. This activity is suspicious as these directories should primarily contain source code or web application files, not executable tools. The detection specifically looks for these executables being created or modified by processes commonly associated with code repositories or command-line operations (git, powershell, curl, cmd).
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
Identifies Task Manager spawning dumps of the LSASS process space, which are subsequently staged in temporary locations. This activity is associated with the UNC6692 threat group.
Detects the execution of tools writing Active Directory database components (ntds.dit, SAM, SYSTEM, SECURITY) directly into user download directories. This activity is indicative of credential harvesting, specifically targeting Active Directory database files.
Detects the browser data collection routines matching Opcodes 0x23 (Chrome) and 0x2B (Edge) creating database snapshots, specifically looking for file creations with names matching 'chrome_backup' or 'edge_backup' initiated by 'setup.exe'.
Detects the creation of an executable with a 64-character hexadecimal filename, which is a common pattern for Makop ransomware variants when dropping their payloads.
Hunts for the creation of hidden keylogger output files formatted with MD5 hashes (s<MD5> or c<MD5>) within the deceptive /usr/share/man9/ph/ directory, as observed in Velvet Ant activity.
Page 157 of 217