Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Identifies the execution of a specific decoy PDF document, '000b67d70f3876965bb09fd37164b7ccrezervaci.pdf', within 5 minutes of its creation. This activity is associated with the 'Dragon Weave' campaign, where the document is used as a lure to distract the victim during an infection.
Correlates the extraction of the Hiring Portal zip file with the immediate execution of its payload. This rule detects the creation of files within a 'Hiring Portal' folder followed by the execution of 'setup.exe' from within a 'Hiring Portal' path within a 5-minute window on the same device. This behavior is indicative of the 'Screening Serpens' campaign.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
This rule monitors file system events for the creation of files with common web shell names (e.g., shell.php, cmd.php) within known web server directory paths (e.g., wwwroot, inetpub). The detection of these specific file names in directories typically used for serving web content is a strong indicator of a potential web shell deployment.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects reg.exe saving the SECURITY hive to \Windows\Temp\.
Correlates the drop of a 24-character hex .js file with its immediate execution by node.exe, indicating potential compromise via a supply chain attack like Mastra NPM.
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.
Detects the creation of a Python launcher file with a '.mod' extension in temporary or user library directories by common script hosts (node, python, wscript, cscript, powershell). This activity is indicative of the InvisibleFerret malware (also known as Void DoKkaebi or BeaverTail) which uses such launchers to import newly downloaded .pyd or .so extensions and supply runtime connection arguments.
Detects the creation of 'update-monitor.service' in the systemd directory, a known persistence mechanism for the Miasma toolkit.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects newly written executables within the per-user ClickOnce cache directory that lack valid digital signatures. This rule specifically looks for file creation events of executable files (.exe) in the `AppData\Local\Apps\2.0\` directory, excluding creations initiated by `msiexec.exe` or `explorer.exe`.
Detects the specific xcopy command-line arguments used by APT37 NarwhalRAT to silently copy data from removable drives to a local temporary path. This rule looks for the combination of '/s', '/e', '/y', '/c', '/q', '/h', and '/b' flags used with xcopy.exe, which is indicative of the malware's data staging behavior.
Detects a non-Firefox process creating staged copies of at least three NSS, login, cookie, history, or preference files from Firefox-style profiles. The logic requires the reported SessionGate, Remus, or AnimateClipper structure rather than a standalone executable name.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects the creation of named pipes associated with newly created hex-named executables, indicating Makop multi-threaded coordination. The rule correlates file creation events for executables with hexadecimal names (e.g., '64-character-hex.exe') with subsequent named pipe creation events by the same process within a 10-minute window on the same device. This behavior is indicative of Makop ransomware's inter-process communication mechanism.
Detects file modifications containing specific threat actor emails associated with a Makop ransomware variant. This rule looks for file rename or creation events where the filename contains 'stephanielkfujo@web.de' or 'stephanielklfujo@web.de'.
Detects the SMBExec lateral movement pattern where a command is echoed to a temporary .bat file and then immediately deleted. This technique often involves using `cmd.exe` to write and execute commands on a remote system via administrative shares.
Page 161 of 217