Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects web shell files written to web server directories
Detects web shell files written to web server directories
Detects delivery of malicious Outlook form scripts for persistence
This rule detects files commonly associated with endpoint detection and response (EDR) evasion techniques being staged within 'test' subfolders under a user's 'Documents' directory. The presence of such files (executables, DLLs, PowerShell scripts, or binaries) with names indicating 'loader', 'bypass', 'edr', 'inject', 'payload', 'agent', or 'defender' suggests an attacker is preparing to deploy or test EDR evasion tools on the workstation. This activity could precede a larger attack.
Detects use of macOS resource forks to hide malicious data
This rule detects the creation of files named 'lgf.dat' or 'lg.dat' within a user's Microsoft Vault directory. These file names and location are associated with keylogger activity, specifically as observed in the 'Fishmongers' Arsenal' campaign involving SprySocks malware.
This rule detects the creation of files in the Windows Fonts directory that have specific prefixes (X1, KX1, or KW1) followed by at least three alphanumeric characters, underscores, hyphens, or periods. This pattern is indicative of potential malicious activity, such as the deployment of container files or extensionless executables by malware like SprySocks, which may attempt to hide within system directories.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects the creation of executable files (.exe) by common archive utilities such as 7-Zip, WinRAR, tar, or PowerShell. It specifically targets scenarios where these utilities are used to extract or create executables, which can be indicative of malware unpacking or staging. The rule focuses on the process responsible for the file creation and the type of file being created, aiming to identify potentially malicious activity involving compressed or archived executables.
Targets an unusually large executable produced by 7-Zip, WinRAR, tar, or PowerShell extraction. The UDM rule retains principal and target context for correlation.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
Detects when a non-Outlook process running as SYSTEM accesses Outlook mailbox data files (.pst or .ost). This rule focuses on identifying suspicious access to sensitive email data outside of normal application behavior, retaining principal and target context for correlation.
This rule detects the presence of Remcos RAT by looking for specific strings in memory or files. It identifies a complex PowerShell command used for downloading and executing a base64-encoded payload, which is characteristic of Remcos RAT's infection chain. Additionally, it looks for specific file paths and other PowerShell-related strings often associated with Remcos RAT activity.
Detects PowerShell spawning csc.exe to dynamically compile and drop the uds.exe payload on the endpoint. This rule specifically looks for the creation of 'uds.exe' by a process that was initiated by 'csc.exe', which itself was spawned by 'powershell.exe'.
Detects the creation or modification of 'endpointdlp.dll' and 'data.bin' files on disk, which are key indicators of the MLTBackdoor infection chain prior to DLL sideloading. This rule focuses on the initial staging of these malicious components.
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
Detects if the malicious USOShared-* public folder is created manually via explorer.exe, indicating interactive attacker staging. This specific pattern targets a folder named 'USOShared-' followed by alphanumeric characters and numbers within the C:\Users\Public directory.
Flags any non-web process (e.g., cmd, powershell) that drops the specific install-persistent.php file, indicating post-exploitation script activity related to the ShapedPlugin supply chain compromise.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Detects creation of dot-prefixed hidden files used to hide malware on Linux/macOS
Page 166 of 217