Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or modification of files with specific names known to be associated with Advanced Persistent Threat (APT) groups. This rule identifies potential APT activity by monitoring for the presence of these highly suspicious file names on endpoints.
This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.
Detects creation of macOS Launch Agent plist files for persistence
Detects deployment of macOS startup item plist files for persistence
Detects malicious LNK files using icon smuggling to hide their true nature
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
This rule detects when a file with the '.docm' extension is written to a network share via SMB. The presence of '.docm' suggests a macro-enabled Office document, which is often used in malicious campaigns. The rule specifically looks for the content '.docm' and a backslash character ('\') within the SMB traffic, indicating a file path or content related to a document.
Detects malicious code written to PowerShell profile scripts
Detects delivery of malicious Outlook form scripts for persistence
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Detects malicious files written to Office XLSTART or Word STARTUP folders
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
Detects instances where the Windows COM surrogate (DllHost.exe) writes executable files or scripts to user-writable/temp directories. This proxy file-write behavior indicates potential WSL2 payload staging that bypasses network telemetry.
Detects the creation of specific suspicious files (result.dll, KKN, ND8) in the C:\ProgramData directory, immediately followed by a network connection to known malicious IP addresses. This pattern is indicative of malware dropping and subsequent command and control communication.
This rule detects the creation of common ransomware ransom note filenames on a device. It triggers when two or more distinct ransom note files are created within a 5-minute window, indicating potential ransomware activity.
Detects malicious logon scripts deployed to the NETLOGON share for domain-wide execution
Detects download of UAC bypass and elevation control bypass tools
Detects user execution of malicious files downloaded via email link clicks
Detects executable files embedded inside Office documents for delivery
Page 168 of 217