Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.
Detects execution of 'certificado.exe' or 'crtf.exe' leading to the creation of the batch script 'vvvv.cmd' or 'help.bat'. This activity is associated with the UnregStealer malware.
This rule detects a suspicious activity chain where a Node.js process drops the 'bun.exe' binary to disk, and then the system executes 'bun.exe' within a 5-minute window. This behavior is indicative of potential supply chain attacks or malicious code execution, where Node.js might be used to deploy and run an unauthorized executable.
This rule detects the execution of Node.js processes that include specific attacker IP addresses (23.254.164.123:443 or 23.254.164.92:8000) in their command line arguments, combined with the creation of a file named '.pkg_logs'. This behavior is indicative of the Mastra NPM supply chain attack, where malicious packages drop a logging file after execution.
Correlates the file creation of zuidrt.hta and its execution via mshta.exe, indicating potential malicious activity associated with Operation XENOFISCAL.
Detects the simultaneous creation of .pkg_history and .pkg_logs in a temporary directory, indicating the setup.cjs dropper associated with the Mastra NPM supply chain attack.
Identifies rapid dropping of many distinct files deep within the .npm/_npx/ directory structure, a precursor to worm execution. This rule specifically looks for more than 20 distinct file creations within a 5-minute window in paths matching the regex ".npm[\]_npx[\][0-9a-fA-F]+".
Detects the creation or modification of directories named 'logs', 'persistantstorage', or 'scratchpad' within paths related to PeopleSoft PSEMHUB. This activity could indicate an attacker staging data or setting up persistence, as observed in campaigns like ShinyHunters targeting the education sector with Oracle exploits.
Detects attempts to overwrite web server content files for defacement
Detects download of attacker tools via C2 ingress transfer channels
Detects transfer of offensive tools to lateral movement targets via SMB
Identifies the creation or modification of unattend.xml files outside of expected deployment directories. This behavior may indicate an attempt to exploit the GreatXML zero-day vulnerability, where attackers place a crafted unattend.xml in the recovery partition to bypass BitLocker during a Windows Defender Offline Scan.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
Detects command and control communications via files on removable media
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects the creation of macOS/Linux LaunchAgent property list files associated with 'gh-token-monitor', indicating potential persistence for the Miasma malware family on macOS environments.
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
Detects modifications to /etc/ld.so.preload or the dropping of .so files by scripting languages, a technique SPECTRALVIPER uses to hook system calls and hide its activity.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Page 164 of 217