Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
KQL Query
Detects potential DLL sideloading associated with the Lazarus Group's DreamLoader campaign. This involves legitimate Windows executables (wkspbroker.exe, wksprt.exe) being executed from non-standard directories shortly after a DLL is created in the same location.
This rule detects the creation of executable files (.exe, .dll, .pyd) within browser extension folders (Chrome, Edge, Firefox) followed by a related registry modification within a one-hour window. This behavior is indicative of malicious browser extension installation or modification, often used for persistence or data exfiltration.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
Detects potential exploitation of 7-Zip vulnerabilities CVE-2025-11001 and CVE-2025-11002. The exploit uses a malicious archive to create a symbolic link, which redirects a subsequent file write to an arbitrary, often sensitive, location on the filesystem. This detection looks for a 7-Zip process writing a potentially executable file to an unusual location such as the Desktop, Startup, or System folders.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
This rule detects the creation or modification of cron files or files within standard cron directories on Linux systems. Adversaries often abuse the cron utility to establish persistence or schedule malicious tasks for execution at specific times or intervals. Monitoring these file events can help identify unauthorized scheduling of tasks.
Detects the creation of files commonly associated with Godzilla-forked webshells, such as 'error.aspx', on a web server. Threat actors deploy these webshells for persistent access after exploiting vulnerabilities in web applications like IIS.
This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.
This rule detects the creation of new files within the Microsoft Windows Defender program data folder. It specifically looks for file creation events where the initiating process is not a known, whitelisted Defender process. This behavior could indicate an attempt to tamper with or exploit Windows Defender, potentially to impair its defensive capabilities or to hide malicious activity.
Detects the creation of suspicious files associated with Proof-of-Concept (PoC) exploits targeting the Windows Print Spooler Remote Code Execution Vulnerabilities, specifically CVE-2021-34527 (PrinterNightmare) and CVE-2021-1675. The rule looks for file creations within the ':\Windows\System32\spool\drivers\x64\' directory, which is a known location for files dropped by these exploits.
Detects the use of PowerShell to decode a Base64 encoded string and write it to the filesystem. This technique is used by adversaries, including in the PassiveNeuron campaign, to drop web shells or other malicious payloads.
Detects potential exploitation of the ToolShell remote code execution vulnerability (CVE-2025-53770) in on-premises Microsoft SharePoint servers. Attackers have been observed sending POST requests to the 'ToolPane.aspx' endpoint and subsequently dropping webshells with specific names in the SharePoint LAYOUTS directory.
KQL Query
Detects potential exploitation of the critical SharePoint “ToolShell” zero‑day vulnerability (CVE‑2025‑53770), in which attackers leverage unsafe deserialization of untrusted data in SharePoint’s ToolPane.aspx endpoint to achieve unauthenticated remote code execution via IIS worker process behavior.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
This rule detects the creation of new files within the `/etc/sudoers.d/` directory. Files in this directory can be used to grant specific users or groups elevated privileges without requiring a password, serving as a persistence mechanism for attackers to maintain privileged access.
Detects the creation of suspicious files (jsp, java, class) in SAP NetWeaver directories, which may indicate exploitation attempts of vulnerabilities such as CVE-2025-31324, potentially leading to webshell deployment.
Detects the creation of files with the ".funksec" extension, which is appended to encrypted files by the FunkLocker ransomware. This indicates that a system is actively being encrypted by this specific ransomware.
Detects attempts to create a DLL file in known desktop application dependencies folders (e.g., Slack, Teams, OneDrive) by an unusual process. This activity may indicate an adversary attempting to load a malicious module via DLL search order hijacking for persistence, privilege escalation, or defense evasion.
Page 193 of 217