Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation of 'WerFault.exe' or 'wer.dll' in directories other than the standard Windows system folders (C:\Windows\SoftwareDistribution\, C:\Windows\System32\, C:\Windows\SysWOW64\, C:\Windows\WinSxS\). This activity is highly suspicious and could indicate an attempt at DLL hijacking, specifically targeting the Windows Error Reporting process (WerFault) for privilege escalation, persistence, or defense evasion.
Detects the creation of scheduled tasks in the `C:\Windows\System32\Tasks` directory by processes originating from suspicious locations such as user `AppData` folders, `C:\PerfLogs`, or `C:\Windows\System32\config\systemprofile`. This activity can indicate persistence or privilege escalation attempts by malware or adversaries.
KQL Query from file: 7-Zip CVE-2025-11002 Detection
Detects potential DLL side-loading used by the AdaptixC2 framework, where a malicious DLL is dropped into the C:\Windows\Tasks directory, followed by the execution of a copied msdtc.exe from the same location.
Detects when a 7-Zip process, potentially running from a user directory, writes a file to a sensitive system location. This could indicate a directory traversal attack (e.g., CVE-2025-11001, CVE-2025-11002) where a malicious archive writes a file outside of the intended extraction path. The rule specifically looks for 7-Zip processes initiated from common user-land folders (like Downloads, Desktop, Documents, Temp) creating files in sensitive system directories (like C:\Windows, C:\Windows\System32, C:\ProgramData, or Startup folders), while excluding legitimate installations to Program Files.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Detects when a 7-Zip process creates an executable file in a sensitive system directory. This could indicate exploitation of a vulnerability like CVE-2025-11001 or CVE-2025-11002, where a malicious archive writes a file to an unexpected location to achieve persistence or code execution.
The following analytic detects the creation of screen capture files by the Braodo stealer malware. This stealer is known to capture screenshots of the victim's desktop as part of its data theft activities. The detection focuses on identifying unusual screen capture activity, especially when images are saved in directories often used by malware, such as temporary or hidden folders. Monitoring for these files helps to quickly identify malicious screen capture attempts, allowing security teams to respond and mitigate potential information exposure before sensitive data is compromised.
Detects the use of qoperation.exe with specific command-line arguments to write a JSP file to the webroot, indicating a webshell drop. This activity is associated with a post-authentication step related to CVE-2025-57790, which involves a path traversal vulnerability in Commvault.
The following analytic detects the creation of files with names commonly associated with ransomware notes. It leverages file-system activity data from the Endpoint Filesystem data model, typically populated by endpoint detection and response (EDR) tools or Sysmon logs. This activity is significant because ransomware notes indicate a potential ransomware attack, which can lead to data encryption and extortion. If confirmed malicious, this activity could result in significant data loss, operational disruption, and financial impact due to ransom demands.
Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.
Detects high-fidelity execution of executables spawned from Office applications or browsers after engaging with recruitment-themed lures (e.g., LinkedIn, careers). Focuses on EXE files created and executed within 24 hours in user directories (Downloads, Temp, AppData), reflecting Subtle Snail’s social engineering and document-based initial access methods.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects the creation of SSH key files in the ~/.ssh/ directory. It leverages filesystem data to identify new files in this specific path. This activity is significant because threat actors often create SSH keys to gain persistent access and escalate privileges on a compromised host. If confirmed malicious, this could allow attackers to remotely access the machine using the OpenSSH daemon service, leading to potential unauthorized control and data exfiltration.
Detects the creation of nsswitch.conf files in non-standard directories, which may indicate exploitation of CVE-2025-32463. This vulnerability requires an attacker to create a nsswitch.conf in a directory that will be used during sudo chroot operations. When sudo executes, it loads malicious shared libraries from user-controlled locations within the chroot environment, potentially leading to arbitrary code execution and privilege escalation.
This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. These files typically facilitate process hiding, credential theft, and backdoor access. Monitoring for such file creation patterns enables early detection of rootkit deployment before full compromise.
The following analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. It leverages endpoint data on process and filesystem activity to identify processes responsible for creating these files. This activity is significant as it may indicate exploitation of a critical zero-day vulnerability in MOVEit Transfer, used by threat actors to install malicious ASPX files. If confirmed malicious, this could lead to exfiltration of sensitive data, including user credentials and file metadata, posing a severe risk to the organization's security.
The analytic detects file writes with extensions indicative of a SamSam ransomware attack. It leverages file-system activity data to identify file names ending in .stubbin, .berkshire, .satoshi, .sophos, or .keyxml. This activity is significant because SamSam ransomware is highly destructive, leading to file encryption and ransom demands. If confirmed malicious, the impact includes significant financial losses, operational disruptions, and reputational damage. Immediate actions should include isolating affected systems, restoring files from backups, and investigating the attack source to prevent further incidents.
Detects the installation of browser extensions, primarily cryptocurrency wallets, that are known targets for the Stealit information stealer.
Detects the creation of files with executable or script extensions by Microsoft Office applications. This behavior can indicate an attempt to drop and execute malicious code, often associated with initial access or execution phases of an attack. The rule specifically looks for common Office applications creating files with extensions like .exe, .dll, .ps1, .vbs, etc., while filtering out known legitimate activities.
Detects a two-stage behavior characteristic of the SonicCrypt crypter: 1) A process creates a suspicious executable in a Windows system directory. 2) The newly created executable is then launched by the Windows Task Scheduler.
Page 195 of 217