Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects a newly launched module creating a hidden or randomly named working directory used to stage configuration, tasks, and output. The rule specifically looks for file creation events (EventCode=11) in common application data directories (appdata, programdata, temp) where the filename matches a pattern indicative of a hidden or randomly named directory followed by specific subdirectories like 'config', 'tasks', 'jobs', 'output', or 'cache'.
Detects users interacting with Tax-themed phishing lures (e.g., W2, 1099, Tax Return) where Microsoft Word executes a macro that drops an executable to disk.
Maps the Python interpreter dropping PE files (.exe) into temporary directories, a behavior associated with stage 2 loaders embedded in AI models.
This rule specifically flags the creation of executable files (.exe) in the unusual C:\Users\Public\Documents\ path, which is often used by malware for staging purposes, as observed in Operation Silent Rotor. The detection looks for a specific naming convention of 6 alphanumeric characters followed by '.exe'.
Detects the creation, renaming, or modification of 'vcpktsvr.exe' and 'libcef.dll' within a directory path containing '\vcpacket'. The rule specifically looks for the co-occurrence of both files within a 10-minute window on the same device, indicating the presence of the Windows ZiChatBot malware stage, which is known to use DLL side-loading.
Detects .NET processes creating a high volume of files with random 4-character extensions, excluding common temporary and log files. This behavior is indicative of the Chaos ransomware, which MuddyWater has used as a distraction for espionage.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Detects attempts by non-browser processes to access sensitive Chromium-based browser data files such as Login Data, Cookies, History, Web Data, and Local State. This rule focuses on file creation events and excludes legitimate browser processes from the principal. The UDM rule retains principal and target context for correlation.
This rule detects the creation of files in the Windows Fonts directory that have specific prefixes (X1, KX1, or KW1) followed by at least three alphanumeric characters, underscores, hyphens, or periods. This pattern is indicative of potential malicious activity, such as the deployment of container files or extensionless executables by malware like SprySocks, which may attempt to hide within system directories.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
Oversized Executable Created by Archiver
Cortex XDR
This rule detects the creation of an executable file with an unusually large size by common archiving utilities such as 7-Zip, WinRAR, tar, or PowerShell extraction. The rule focuses on the causality chain to identify the process responsible for creating the oversized executable, which can be indicative of malware packing or other suspicious activity.
This rule detects the creation of specific files (lgf.dat or lg.dat) within a user's Microsoft Vault directory, which are indicative of keylogger activity. The rule leverages Cortex XDR data to provide causality and actor information for investigation.
Detects files using double extensions to disguise executable payloads
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup. This technique was observed in a campaign deploying obfuscated batch scripts disguised as PNG files into the Startup folder.
This rule detects the creation or modification of files with specific SHA256 hashes known to be associated with adware. It monitors device file events for these hashes and logs instances where they are created or modified.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
Page 163 of 217