Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by JavaScript runtimes (like node or bun). This activity may indicate a supply chain backdoor attempting to establish persistence within a project by modifying development environment configurations.
Detects download of remote access tools following vishing contact
Detects installation of application shim databases for execution hijacking
Detects download of disk image files used to bypass Mark-of-the-Web
Detects the creation or renaming of the 'SmartPrintScreen.exe' file within the specific staging directory '\ProgramData\SmartPrint\' used by the LotusLite dropper. This activity indicates the staging of malicious files prior to execution.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
This rule detects when a single process rapidly creates or modifies three or more YAML files (files ending with '.yaml' or '.yml') within an hour. It specifically looks for these activities in paths containing 'config' or 'pipeline', which could indicate configuration changes, deployment activities, or potential malicious manipulation of system or application settings.
This rule detects when a single process account creates or copies 10 or more files to a removable media device (e.g., USB drive) within a one-hour window. This behavior can be indicative of data exfiltration attempts.
This rule detects suspicious file export activity by monitoring for the creation of files with names containing keywords like 'export', 'dump', or 'extract'. It triggers an alert if five or more such files are created by the same account within a one-hour window, indicating potential data exfiltration or staging.
Payload Ransomware File Artifacts
Cortex XDR
Detects the creation of files with the .payload extension or the RECOVER_payload.txt ransom note, indicating active encryption by Payload ransomware.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
Identifies the creation or execution of the specific JavaScript file named 'Remittance Advice.js' used in the initial access phase of the Evil MSI Background steganography campaign.
Detects the creation or modification of suspicious web-related script files (PHP, ASPX, JSP, SHTML) in common web server directories, excluding activities from legitimate web server processes. This rule aims to identify potential webshell deployment or other post-exploitation activities, specifically linked to APT28's targeting of Roundcube webmail servers.
Detects the creation of hidden executables deep within the AppData\Roaming directory, a characteristic behavior of PureHVNC for persistence.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
Detects the creation of the '.bun_ran' run-once marker in a temporary directory or suspicious Python '.pth' startup hooks (e.g., 'langchain_core-setup.pth') indicative of the Hades loader variant. The '.bun_ran' file acts as a marker for the loader, while '.pth' files can be used to inject malicious code into Python's import mechanism, achieving persistence or execution.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
This rule looks for a package writing a short-lived JavaScript file with a p-prefix name in temp during install. That pattern matches known stealers and wipers. Quarantine the package version. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
Page 169 of 217