Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of 'hyper-v.ver' in the LocalAppData directory, which is used by RMMProject for storing client UUIDs. This activity indicates potential persistence or identity tracking by the RMM tool.
Detects creation, modification, or renaming of 'help.php' within a REDCap application path. This activity is indicative of a web shell deployment, as observed by GTIG with UNC6508 using 'help.php' for persistence and payload uploads. The combination of the campaign-specific filename and REDCap path provides a high-confidence signal.
Detects the creation of systemd unit files masquerading as Google Chrome components used to launch the GS-Netcat backdoor on boot.
Detects opening of macro-enabled Office documents potentially containing malware
Detects a legitimate, signed Microsoft binary being programmatically copied out of System32 into C:\Users\Public via cmd.exe to prepare the DLL sideloading staging ground. This activity is associated with the Nimbus Manticore threat actor.
Detects the presence of known malicious VS Code extension files disguised as Jupyter Notebook and markdown tools, which act as a multi-stage backdoor utilized by North Korean threat actors. The rule specifically looks for file creation events of VSIX files with names associated with a known campaign.
Detects the creation, modification, or renaming of the 'com.finder.helper.plist' file in the '/Library/LaunchDaemons/' directory, which is a specific persistence mechanism used by the AMOS stealer malware. This rule specifically targets the root-level persistence method.
Detects the creation of large archive files (zip, rar, 7z, tar.gz) exceeding 50MB in common temporary or program data folders, specifically when these archives are created shortly after files from user document directories (Documents, Desktop, Downloads, Finance, HR, Accounting) were copied or read. This behavior is indicative of data staging by the MedusaLocker ransomware variant prior to encryption or exfiltration.
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
This rule detects the presence of specific files and API calls associated with the SprySocks malware, which functions as a keylogger. It looks for 'lgf.dat' and 'lg.dat' files within a 'Microsoft\Vault' directory, combined with the presence of keylogging-related API functions like 'GetClipboardData', 'GetForegroundWindow', and 'GetAsyncKeyState'. This combination indicates potential keylogger activity on a Windows system.
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects WMI Managed Object Format (MOF) files creating persistent event subscriptions
Detects the creation of specific systemd service files, macOS LaunchAgents, or payload files ('update.py') used by the Miasma toolkit for its GitHub polling backdoor. This rule identifies file creation or modification events indicative of the Miasma toolkit establishing persistence on Linux and macOS systems.
Detects malicious executables dropped to shared network folders
Detects when scripting language interpreters (Node, Python, Bun, NPM) create or modify files within the '/etc/cron.d/' directory. This activity is suspicious as it may indicate a compromised package or malicious actor attempting to establish system-wide persistence via scheduled tasks.
Detects non-standard scripts altering the authorized_keys file to inject attacker SSH public keys, providing persistent backdoor access to the compromised machine. Specifically looks for modifications or creations of 'authorized_keys' files by 'node', 'python', or 'bun' processes.
Hunts for the fake VPN creating highly randomized, high-entropy directories in %AppData% to store its persistence binaries. This rule specifically looks for folder creation events in the AppData\Roaming directory with a highly randomized, 12 or more character alphanumeric name, and correlates it with a process event from either GlobalProtect or AnyConnect VPN clients.
Advanced time-series detection of a single installer process dropping both a known RMM tool artifact and an anomalous executable within 10 seconds.
Correlates the creation of the RESTORE_FILES.txt or GENTLEMEN_README.txt ransom note in multiple directories across the file system, specifically when more than 5 notes are created within a minute by the same process on a device.
Correlates the ClickFix execution directly to the creation of the NetSupport RAT files (client32.exe) in public directories, specifically when PowerShell is used to access the clipboard.
Page 162 of 217