Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the deployment of the 'session-manager.php' MU-Plugin backdoor characteristic of the ErrTraffic 'Analytics' cluster on WordPress servers by monitoring file creation events in the 'wp-content/mu-plugins' directory for the specific filename 'session-manager.php'.
Detects PowerShell downloading an archive and expanding it into a user-writable directory with mining-related filenames or parameters. This behavior is indicative of cryptojacking campaigns where adversaries use compromised systems to mine cryptocurrency.
Detects the creation or execution of a file named 'agt.dll' within a masqueraded 'CorsairUtil' directory, a defense evasion tactic used by the Vidar Turb00 campaign. This rule monitors both file drops (DeviceFileEvents) and DLL loads (DeviceImageLoadEvents) for the specific path and filename combination.
Detects the creation of 'Screenshot.jpg' in the AppData directory by PowerShell. This activity is often associated with malware like PS1Bot attempting to capture screenshots of the user's desktop.
This rule detects the creation of executable or script files (e.g., .exe, .dll, .ps1, .bat, .cmd) by wscript.exe or cscript.exe within common user-writable directories such as AppData, Temp, Downloads, Documents, or Music. This activity can be indicative of malicious VBScript execution attempting to drop and execute secondary payloads, often associated with phishing campaigns.
Detects malicious files written to Office XLSTART or Word STARTUP folders
Generic rule content from file: untitled_rule
Detects malicious ClickOnce application manifests for proxy code execution
This rule detects the creation of files with names commonly associated with ransomware notes (e.g., 'ransom_note', 'decrypt_files', 'pay_ransom') and common text file extensions (.txt, .html, .htm). It summarizes these events by device and time, flagging devices where at least one such file is observed.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
This rule detects the creation of specific disguised .lnk files (e.g., ChromeSetup.lnk, Firefox Installer.lnk, AnyDesk.lnk) which are known to be used by the DeepLoad malware for USB-based lateral movement.
Detects the creation or modification of VS Code tasks.json files outside of normal IDE or version control operations. Threat actors, such as North Korean groups, are weaponizing the "runOn: folderOpen" feature in tasks.json for auto-execution when a cloned repository is opened.
This rule detects the creation of suspicious files, specifically .lnk files or files containing 'JUNCTION' in their name, within the 'AppData\Local\Temp' directory. It further refines the detection to look for paths that contain '..\', indicating a recursive or unusual directory structure, which can be used to hide malware or evade detection.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (AppData\Roaming\Microsoft\Windows). This activity is suspicious as Notepad++ DLLs are not typically found in this location and could indicate an attempt at DLL side-loading or other forms of execution hijacking.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Detects the creation of web shells (.aspx, .ashx) in the SmarterMail web root directory by the mail service process. This is a common persistence mechanism used by attackers after exploiting vulnerabilities like CVE-2026-24423 to maintain remote access.
Detects the PUP installer dropping an outdated, legitimate application (e.g., old versions of VLC or Notepad++) alongside a malicious DLL to execute a sideloading attack. The rule identifies file creation events for DLLs followed by an image load event for an unsigned DLL within a short time frame, where the initiating process for the image load has a valid signature.
Identifies the deceptive, deeply nested directory structure used to hide the persistent payload, specifically looking for folder creations matching the pattern `AppData\LocalLow\LocalLow\sWindows\Program\sRules\Program\sRules\sNVIDEO`.
This rule detects a potential HTML smuggling attack where a browser (Chrome or Edge) saves a file (specifically ISO, IMG, VHD, ZIP, or RAR extensions) via a JavaScript Blob, and that same file is executed by the user via Windows Explorer within a 10-minute window. This chain of events is indicative of a phishing technique used to bypass traditional security controls.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Page 160 of 217