Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Identifies the creation of a .config file matching a newly relocated executable's name, used to force the .NET runtime to load the TOTPGuard.dll AppDomainManager. This rule specifically looks for the simultaneous creation of an executable (.exe) and a corresponding configuration file (.exe.config) in the same directory, which is a known technique used by the Nimbus Manticore threat actor for AppDomainManager hijacking.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects Hannibal Stealer reconnaissance activity involving the creation of a 'config.json' file within the 'SCef.WindowsAdapter' directory, correlated with suspicious process executions attempting to enumerate system information via 'GetComputerNameEx' or 'GetAdaptersInfo' API calls.
Detects the simultaneous extraction of at least three different script types (VBS, PS1, JS, or DAT) from archives, followed by their execution by their respective interpreters (wscript.exe, powershell.exe, node.exe, or bun.exe). This behavior is indicative of multi-stage attacks where adversaries use various scripting languages for different phases of their operations, often to evade detection or to ensure compatibility across different system configurations. The inclusion of '.dat' files suggests that the rule is also looking for potentially obfuscated or custom script formats that are then interpreted by one of the listed executables.
Detects the installation of Meow RAT persistence mechanisms on macOS by monitoring for the creation or modification of specific LaunchAgent or LaunchDaemon .plist files, particularly those named 'com.apple.accountsd.plist', and subsequent 'launchctl load' commands for these files. This rule identifies attempts to establish persistence by masquerading as legitimate system processes.
Detects the threat actor dropping the vulnerable EnCase driver (EEDbg.sys or similarly signed legacy driver) to disk to initiate the BYOVD attack.
Detects the creation of localized staging directories with suspicious names in public paths, used to temporarily hold compressed data before exfil. The rule specifically looks for folder creations under 'C:\Users\Public\' with names like 'Exfil', 'Data', 'Staging', or 'Dump'.
Detects the core payload components dropped by the malicious easy-day-js npm package, which is an infostealer affecting developers and CI/CD environments. The rule specifically looks for the creation or modification of 'protocal.cjs' and 'config.json' within a hidden 'NodePackages' directory located in 'C:\ProgramData\', a technique used to masquerade as legitimate Node.js tooling.
Identifies the execution of the W2 malvertising loader dropping known vulnerable drivers (e.g., RTCore64, gdrv, procexp) to disk for the Bring Your Own Vulnerable Driver attack. This rule specifically looks for '.sys' files being created in common temporary or user-specific directories (Temp, AppData\Local, Users\Public) where the initiating process was a web browser (chrome.exe, msedge.exe) or explorer.exe.
Identifies rundll32.exe executing a DLL with a randomized or anomalous export function, combined with evidence of a DLL file being created on the system. This behavior is indicative of Matanbuchus DLL sideloading.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
End-to-end correlation: Fake AI installer executes -> Drops pythonw.exe -> Network connection to Vidar C2.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
This rule detects a highly complex correlation where a web server process (w3wp.exe) drops a file named 'install-persistent.php' and then, within one hour, 'schtasks.exe' executes a command that includes 'install-persistent.php'. This pattern is indicative of a web shell being dropped and then scheduled for execution, potentially as part of a supply chain compromise.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Detects installation of malicious Office add-ins for persistent macro execution
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
Page 158 of 217