Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
The following analytic identifies a process writing a .txt file to a world writable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on file creation events within specific directories. This activity is significant as adversaries often use such techniques to deliver payloads to a system, which is uncommon for legitimate processes. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.
This rule detects activities associated with the RomCom threat group, including exploitation of CVE-2025-8088 (WinRAR path traversal), COM hijacking for persistence, anti-analysis techniques (RecentDocs check), C2 communication, and suspicious WMIC execution, potentially linked to a Mythic agent.
Detects the creation of specific ASPX web shells in the SharePoint LAYOUTS directory, a TTP associated with the exploitation of the 'ToolShell' vulnerabilities (e.g., CVE-2025-49706, CVE-2025-53770).
Detects the dual-use tool ADExplorer writing a complete Active Directory snapshot into a .dat file. This activity can be leveraged by attackers for various purposes, including data extraction for tools like Bloodhound, gathering usernames for password spraying attacks, or utilizing metadata for social engineering. While the snapshot typically does not contain password hashes, there have been instances where administrators inadvertently stored passwords in comment fields within Active Directory, which could then be exposed through such snapshots.
Detects when the explorer.exe process makes a network connection over SMB to a remote host and subsequently creates an executable file. This behavior is indicative of CVE-2025-50154, where a specially crafted LNK file can cause explorer.exe to silently download a binary from a remote share without user interaction.
KQL Query designed to detected tactics employed during active exploitation of WinRAR Zero-Day ( CVE-2025-8088)
This detection identifies the use of two drivers, rwdrv.sys and hlpdrv.sys, which have been observed in Akira ransomware campaigns. The activity includes dropping these drivers, creating associated services, and disabling Windows Defender.
This query identifies browser extensions with a low global prevalence, which could indicate a malicious or unwanted extension. It specifically looks for .crx files created in "Webstore Downloads" folders and enriches the data with file prevalence information.
Detects the creation of files and services associated with malicious drivers (hlpdrv.sys, rwdrv.sys) used by Akira ransomware affiliates for defense evasion, as reported by GuidePoint Security. This rule specifically looks for the creation of these driver files and the associated service registrations in the Windows Registry.
This rule detects processes that are taking an unusually high number of screenshots within a defined timeframe. It identifies screenshot activity by looking for specific action types like "ScreenshotTaken", file creations with common image extensions (.png, .jpg, .jpeg, .bmp, .gif, .tiff), and process command lines containing common Windows API calls related to screen capturing (e.g., BitBlt, GetDC, PrintWindow, CopyFromScreen). The rule aggregates these events per device and triggers an alert if the total number of screenshots exceeds a configurable threshold.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This detection identifies the creation of Remote Desktop Protocol (RDP) bitmap cache files on a Windows system, typically located in the user’s profile under the Terminal Server Client cache directory. These files (*.bmc, cache*.bin) are generated when a user initiates an RDP session using the built-in mstsc.exe client. Their presence can indicate interactive remote access activity and may be useful in detecting lateral movement or unauthorized RDP usage. Monitoring this behavior is especially important, as attackers may attempt to delete or suppress these artifacts to evade forensic analysis.
The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
This rule detects the creation of JavaScript files in the `AppData\Local\Temp` directory with a specific naming convention that resembles a GUID followed by a short alphanumeric e.g. or string and the '.js' eb2262cf-d737-4d55-9b98-84324ade4763ro.js.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This pattern is often used by malicious scripts or droppers that generate temporary files with randomised names to evade detection.
This detection monitors the creation or modification of the Default.rdp file, typically found in the user's Documents folder. This file is automatically generated or updated by the Remote Desktop Connection client (mstsc.exe) when a user initiates an RDP session. It stores connection settings such as the last-used hostname, screen size, and other preferences. The presence or update of this file strongly suggests that an RDP session has been launched from the system. Since this file is commonly overlooked, it can serve as a valuable artifact in identifying remote access activity, including potential lateral movement or attacker-controlled sessions.
This query detects multiple behaviors associated with the ApolloShadow malware, used by the Secret Blizzard threat actor. It looks for the creation of a specific administrator account, installation of root certificates using certutil, modification of Firefox settings to trust new certificates, and changes to network profiles to relax firewall rules.
Detects the creation or modification of an unsigned Spotlight importer (.mdimporter) bundle within a user's Library/Spotlight directory on macOS. This activity is indicative of the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker leverages a malicious, unsigned importer to gain unauthorized access to TCC-protected data via the mds/mdworker processes.
Detects the creation of a Spotlight importer bundle (.mdimporter) in a user's Library directory. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where an attacker places a malicious importer to be executed with elevated privileges by the mds_stores process, allowing unauthorized access to TCC-protected data.
This rule detects the creation or modification of ASPX/ASP files within specific SharePoint web server directories on devices identified as vulnerable to CVE-2025-49706 or CVE-2025-53770. It leverages vulnerability management data to narrow down the scope to only vulnerable SharePoint servers, then monitors file events in common SharePoint LAYOUTS paths for web shell indicators. The rule also uses file profiling to identify potentially novel or malicious ASPX/ASP files that lack Defender visibility.
Page 199 of 217