Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation or modification of files with names suggesting they contain plaintext credentials, such as passwords or recovery codes. This is a common tactic used by threat actors to find and steal credentials for lateral movement and privilege escalation.
Detects the creation of a file containing 'spinstall0' in specific SharePoint LAYOUTS directories. This activity is a strong indicator of successful post-exploitation of the SharePoint Server vulnerability CVE-2025-53770, where an attacker has likely placed a web shell for persistent access.
Detects the creation of a malicious executable named 'My Pictures.exe' on a removable drive, a technique used by VenomRAT for lateral movement.
This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").
Detects a command-line interpreter (cmd.exe or powershell.exe) writing a file to a SharePoint (\TEMPLATE\LAYOUTS) directory.
Detects a sequence of file creations (.svg, .zip, .bat) on a single host within a short time window, which is indicative of a malicious SVG-based download campaign delivering payloads like XWorm and Remcos.
Detects attempts to replace the legitimate UEFI bootloader (bootmgfw.efi) with a malicious one by creating a backup (.old file) and modifying the original. This is a critical persistence technique used by the HybridPetya ransomware.
The analytic detects the creation of an Outlook Macro (VbaProject.OTM) by a suspicious process. This file is normally created when you create a macro from within Outlook. If this file is created by a process other than Outlook.exe it may be maliciously created. This detection leverages data from the Filesystem datamodel, specifically looking for the file creation event for VbaProject.OTM. This activity is significant as it is commonly associated with some malware infections, indicating potential malicious intent to harvest email information.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
Detects the creation of files in a deceptive directory 'C:\Windows \System32\' (with a space after 'Windows'). This technique is used by a Zephyr/XMRig cryptomining campaign to stage files for DLL search order hijacking of 'printui.exe'.
Detects TTPs associated with a Lazarus subgroup using the SessionEnv service for persistence and privilege escalation. This involves phantom DLL loading, service auto-start configuration, and registry modification for elevated privileges.
Detects hard IoCs and activity associated with a trojanized installer of Velociraptor incident response tool making callbacks to C2 domains from workers[.]dev and tunneling with Visual Studio Code (code.exe). The detection looks for the creation of hard IoCs from this malicious Velociraptor installer V2.msi, followed by network connections to known C2 domains and the execution of related processes, including PowerShell (with support for detecting encoded commands to install code.exe) and msiexec activity tied to malicious domains.
Detects the PerfhLoader persistence technique used by the Lazarus Group, which involves modifying the 'SessionEnv' service to start automatically and either adding sensitive privileges or dropping a malicious DLL for phantom loading. This rule correlates events across process launches (sc.exe modifying SessionEnv service), registry modifications (adding privileges to SessionEnv service), and file creations (dropping a specific DLL for phantom loading).
Detects the creation of malicious drivers used by an EDR Killer tool. This tool is leveraged by numerous ransomware groups, including RansomHub, Blacksuit, Medusa, and INC, to disable security products before deploying ransomware. The detection is based on known malicious file hashes and drivers signed with specific, known-abused certificates.
This analytic detects the use of Windows command-line copy utilities, such as xcopy, to systematically collect files from user directories and consolidate them into a centralized location on the system. This activity is often indicative of malicious behavior, as threat actors frequently use such commands to gather sensitive information, including documents with .doc, .docx, and .pdf extensions. The detection focuses on identifying recursive copy operations targeting user folders, such as Documents, Desktop, or other directories that commonly store personal or organizational files. Malware that performs this behavior typically attempts to evade detection by using legitimate Windows utilities, executing commands through cmd.exe or other scripting hosts, and writing the collected files to directories like C:\ProgramData or temporary storage locations. Once collected, the information may be staged for exfiltration, used for lateral movement, or leveraged for further compromise of the environment. By monitoring for these types of file collection patterns, security teams can identify suspicious activity early, differentiate between normal administrative tasks and potentially malicious scripts, and prevent sensitive data from being exfiltrated. This analytic is particularly relevant for environments where confidential documents are present and attackers may attempt to harvest them using built-in Windows tools.
This rule detects suspicious file write and network activity that may indicate data exfiltration from a Windows Server using common tools like curl, ftp, or powershell. It correlates file creation/modification events with outbound network connections made by known exfiltration tools within a 5-minute window. This is useful for identifying insider threats, compromised servers, and automated exfiltration scripts.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
Detects the creation of a randomly named LaunchDaemon .plist file in /Library/LaunchDaemons/, a technique used by Odyssey Stealer for persistence.
Detects the creation of hidden configuration files used by the Odyssey Infostealer on macOS. These files are known to store sensitive data like passwords, C2 server details, and bot identifiers.
Detects a file being created in a temporary macOS directory, made executable, and then executed by a shell. This behavior is consistent with the Odyssey Infostealer, which downloads and runs scripts from temporary locations.
Detects the creation of keylogger output files by the WinMainSvc component, which is associated with the Crypto24 ransomware group. The keylogger runs as a service via svchost.exe and creates log files in the C:\Windows\tmp\ directory with a specific naming pattern.
Page 198 of 217