Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects large data transfers to removable storage media for physical exfiltration
Detects delivery of malicious dylib files for macOS library hijacking
Detects download of potentially malicious browser extension CRX packages
This rule detects an anomalous burst of file creation activity within the .npm/_npx/ cache directories. This behavior is often observed preceding the drop of malicious executables, such as 'bun.exe', as part of supply chain attacks targeting npm packages. The rule triggers when 10 or more files are created in these specific cache folders within a one-minute window on a single device.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects the creation of hidden files (starting with a dot) in the `/tmp` directory on Linux systems. This behavior can be indicative of malware like Miasma hiding intermediate exfiltration data or configuration files.
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.
Detects the native utility finger.exe being copied to a temporary directory using cmd.exe, which can be an indicator of Living Off The Land Binaries (LOLBins) abuse.
Detects the creation of 'msedge.zip' in the 'C:\ProgramData\' directory, which is an indicator of Node.js staging, often associated with malicious activity.
Detects PS1Bot generating randomly named .lnk files in the Windows Startup folder using PowerShell.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
This rule detects an unusual number of file creations or modifications (5 or more within an hour) of executable (.exe) or dynamic link library (.dll) files within folders containing 'build' or 'release' in their path. This activity could indicate software deployment, compilation, or potentially malicious activity such as the staging of malicious executables or libraries.
Detects modification of SSH authorized_keys files for backdoor access
Detects the creation of specific staging archives and log files used by Lucid Stealer before exfiltration. This rule looks for 'uac.log.txt', 'lucid_err.log', or 'Data_*.zip' files being created in the user's local temporary directory.
Detects creation of LNK shortcut files from browser or email context
Detects execution of Electron application ASAR packages for code execution
Detects file creation or renaming events indicative of BlackCat/ALPHV ransomware encryption activity. The rule looks for specific file name patterns and extensions associated with this ransomware, such as '.blackcat', '.b1ack', '.alphv', or '.encrypted', and triggers if 20 or more such files are observed within a 5-minute window on a single device.
Detects files with suspicious double extensions (e.g., .exe.txt, .dll.txt) or .scr extension, which can indicate an attempt to masquerade malicious executables or scripts as benign text files or screensavers. The rule excludes files in the System32 directory to reduce false positives.
This rule detects the creation or renaming of files with specific names associated with Deimos ransomware, including '.deimos', '.payment_id', or 'deimos_note'. These file names are commonly used by Deimos ransomware for encrypted files or ransom notes.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
Page 167 of 217