Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Detects a non-OneDrive process creating files, result, and job subdirectories associated with cloud-hosted tasking, indicative of GraphWorm or similar malware activity leveraging OneDrive for command and control or data staging.
Detects executable or script files dropped in the deceptive Windows sound diagnostics package folder, representing decoded payload bytes.
Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.
Detects VSPMsg.dll written beneath the x64 print processor directory from ProgramData or another staging path. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Detects the creation of a potentially malicious 'index.js' file within a suspicious application data folder, specifically targeting the 'SuperMaxionQuickMaxlite' directory. This pattern is often associated with Electron-based malware or modified legitimate applications.
Detects the extraction of a ZIP archive via tar.exe to the %TEMP% directory. This activity is often associated with malware unpacking or staging, where an adversary extracts malicious content into a temporary location for execution.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Detects the creation of a file named 'svchost.log' in a randomly named subdirectory within 'AppData\Local', which is indicative of EtherRAT malware storing its base64 encoded JSON configuration.
Detects the malware copying itself into the localized cache directory under the hardcoded campaign ID D3F4E2A1, specifically looking for 'RuntimeHost.exe' being created in that path.
Employs regex to identify the highly specific, deceptive, deeply nested directory structure (LocalLow Windows\Program Rules NVIDEO) used to hide the persistent payload.
Detects the deployment of MeshCentral remote access agents and the creation of a specific ransom note file on compromised PeopleSoft servers, indicative of ShinyHunters activity. The rule looks for the creation of a file named 'README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT' or the execution of 'meshagent' or 'meshcentral' processes from suspicious directories or initiated by common shell/download utilities.
This rule detects the creation or modification of files with the '.prinzeugen' extension, which is indicative of the Prinz Eugen ransomware. It specifically looks for these files in common user directories such as 'Users', 'Documents', 'Downloads', and 'Desktop' within the last hour, suggesting recent ransomware activity.
Generic rule content from file: MLTBackdoor File Creation
This rule detects patterns associated with the APT29 Wineloader backdoor. It looks for the creation of ActiveX objects for Wscript.Shell and Scripting.FileSystemObject, XMLHttpRequest for HTTP requests, specific `certutil -decode` commands, `tar -xf` commands, the presence of `SqlDumper.exe` in a specific path, and generic URL patterns. These indicators suggest potential execution of malicious scripts, file manipulation, data exfiltration, and command and control communication.
This rule detects the creation or modification of files on a device that match a list of known malicious SHA256 hashes. It identifies potential malware presence based on file integrity.
Detects systemd timer unit file creation for Linux scheduled task persistence
Detects the staging of Miasma exfiltration payloads, specifically JSON files matching the 'results-*.json' naming convention, and Git operations interacting with these files. Miasma is known to exfiltrate harvested credentials by creating public GitHub repositories and committing encrypted JSON files with this specific naming convention.
This rule alerts when a new format-check workflow is created matching malicious supply-chain templates. These workflows run on every push and can steal secrets. Require security review for all new workflow files. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule identifies when a single account creates three or more files containing 'backup', 'export', or 'dump' in their filenames within a one-hour period. This activity could be indicative of data staging for exfiltration or an attempt to back up sensitive information prior to a malicious action.
This rule detects a high volume of file creation or modification events on removable media (e.g., USB drives). A count of 10 or more file operations within a one-hour window by a single initiating process account on paths containing 'USB' or 'Removable' is considered suspicious and may indicate data exfiltration or staging.
Page 165 of 217