Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects suspicious command-line activity indicative of a Remcos RAT loader attempting to establish persistence by copying or moving an executable (.exe) file into the AppData\Roaming directory. It specifically looks for 'cmd.exe' or 'powershell.exe' executing commands that contain both 'AppData\Roaming' or '%APPDATA%' and file manipulation commands ('copy', 'move', 'xcopy', 'REM') along with an '.exe' file extension.
Hunts for the malware compressing the collected host and browser data into a temporary .zip file prior to network exfiltration. Specifically looks for file creation events of .zip files with a specific naming convention (8-15 alphanumeric characters) in common temporary directories, initiated by 'AutoIt3.exe'.
Detects a module writing command results, screenshots, file listings, or collection output into a dedicated hidden working directory. This rule specifically looks for file creation events (EventCode 11) in common temporary or application data directories, where the filename matches a pattern indicative of staged results (e.g., 'result', 'output', 'jobs', 'tasks', 'stage' followed by common data file extensions).
Detects repeated creation attempts for the same mutex, pipe, lock file, or loopback endpoint by several module processes, leaving one active leader. This behavior is indicative of the Kazuar malware establishing a leader election mechanism to coordinate its activities on a compromised system.
Correlates the creation of randomized staging directories /tmp/shub_ indicating SHub Stealer activity.
Detects the creation of specific staging paths utilized by AMOS to organize stolen artifacts before archiving.
Correlates the downloading of the secondary Mach-O backdoor (.mainhelper) into the user's home directory as a hidden file.
Detects the initial Go-compiled dropper binary extracting and writing the intermediate .vbs file to the Temp folder.
Identifies PowerShell commands that copy a .bat file from the %TEMP% directory to the Startup folder, a technique used by Vidar malware for persistence.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders. Specifically looks for .pyc files with 20 or more alphanumeric characters in their name, created in a temporary folder path matching the pattern '_MEI[0-9]+'.
Correlates the dropping of the decrypted XWorm payload into %LOCALAPPDATA% with a name mimicking a Windows Kernel service.
Detects copying executables, scripts, or archives to a remote C$ share immediately before remote execution. This behavior is associated with the 'Gentlemen Ransomware' as described in the referenced Microsoft blog.
This rule monitors for suspicious activity related to Microsoft Exchange servers and potential DLL side-loading. It detects the creation of web shell files (.aspx, .ashx, .asmx) in Exchange-related directories, the execution of command shells (cmd, powershell) by the IIS worker process (w3wp.exe) within Exchange, and the side-loading of DLLs by specific signed binaries (dfsvc.exe, rasautou.exe) from non-standard directories.
Detects the MYRA RAT (Operation Friday Harvest) establishing persistence by creating systemd user services disguised as legitimate system daemons (colord, haveged) under ~/.config/systemd/user/, enabling the service via systemctl --user enable, and dropping binaries to ~/.local/bin/. Also covers related persistence artifacts including /usr/local/lib/.libcache.so and /etc/profile.d/.sh.local. The rule also identifies node or node.exe spawning systemctl with the --user flag.
This rule detects unauthorized access, creation, or modification of browser-specific sensitive credential files (such as 'Login Data' or 'cookies.sqlite') by processes that are not recognized web browsers or trusted update services. This behavior is a common indicator of information-stealer malware attempting to harvest session cookies and stored credentials.
This rule detects suspicious file activity indicative of Prinz Eugen ransomware. It looks for the creation of multiple files (100 or more) with the '.prinzeugen' extension and a file size of at least 1KB, which suggests encryption activity.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
Detects the creation of temporary files with '.prinzeugen.tmp' or generic '.tmp' extensions in common user directories (Users, Documents, Downloads, AppData), which is indicative of Prinz Eugen ransomware activity.
Detects the creation of specific suspicious files (result.dll, KKN, ND8) in the C:\ProgramData directory, immediately followed by a network connection to known malicious IP addresses. This pattern is indicative of malware dropping and subsequent command and control communication.
Detects the creation or modification of Git pre-commit hooks (.githooks/pre-commit). Contagious Interview actors use this technique to automatically execute malicious code when a target clones and interacts with a compromised repository.
Detects the creation of temporary files containing harvested tokens in the /tmp/ directory. This activity is indicative of a script using these files as a staging ground before network exfiltration. The rule specifically looks for file creation events in '/tmp/' where the filename contains 'tokens' and the initiating process is a common shell or text processing utility.
Page 159 of 217