Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of files with double extensions, a common technique used by malware to masquerade as benign files, especially when Windows is configured to hide known file extensions. This rule specifically looks for files ending with common executable or archive extensions (like .exe, .iso, .rar, .zip, .svg) preceded by another common file extension (like .doc, .pdf, .jpg, .png, etc.).
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.
Detects the creation of the "spinstall0.aspx" web shell in a SharePoint server directory, which is a known post-exploitation indicator for the SharePoint vulnerability CVE-2025-53770.
Detects the creation of specific text files in the AppData directory, which is a known behavior of the Katz Stealer malware after it successfully decrypts and dumps browser master keys.
Active exploitation of CVE-2025-53770 involves the creation of this file, indicating successful post-exploitation.
This rule detects the creation of a suspicious file named 'spinstall0.aspx' or similar in a specific SharePoint template directory, which is indicative of a potential compromise related to CVE-2025-49704, CVE-2025-49706, or CVE-2025-53770. Additionally, it identifies network connections to known malicious IP addresses associated with these vulnerabilities.
CVE-2025-53770 Exploitation hunt
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
This rule detects the creation of specific files named 'spinstall0' within the SharePoint Web Server Extensions template layouts directory. This activity could indicate an attempt to install or modify SharePoint components, potentially for malicious purposes or unauthorized changes.
Detects the creation of a randomly named executable (16-character alphanumeric) in common temporary directories (AppData\Local\Temp or C:\Windows\Temp). This behavior is associated with Warlock Dark Army ransomware.
Detects the creation of `spinstall0.aspx`, a known indicator of successful post-exploitation of the SharePoint vulnerability CVE-2025-53770.
Detects the creation of "spinstall0.aspx", a file dropped after the successful exploitation of the SharePoint vulnerability CVE-2025-53770. This file is a known webshell.
Scan for 18 malicious extensions
This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. This file is a known indicator of compromise associated with the exploitation of CVE-2025-53770 (ToolShell vulnerability). Attackers exploit the vulnerability to drop webshells that provide persistent access to compromised SharePoint servers, allowing them to execute arbitrary commands, access sensitive data, and move laterally within the network.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
This detection identifies when a file is created or modified on a host within a short time window after a USB storage device was inserted. This behavior can be indicative of malware spreading via removable media, where a payload is automatically dropped onto the system.
Detects the creation of hidden configuration files or a LaunchDaemon plist file used by the Odyssey Stealer malware to establish persistence on a compromised macOS system.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
Page 200 of 217