Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of files associated with Psychedelic Stealer's persistence mechanism. The malware establishes persistence by installing a malicious native messaging host configuration file (com.lunex.explorer.json) and associated malicious scripts (host.ps1 or host.bat), which allows it to intercept and manipulate web browser native messaging.
Detects the creation of files associated with Psychedelic Stealer's persistence mechanism. The malware establishes persistence by installing a malicious native messaging host configuration file (com.lunex.explorer.json) and associated malicious scripts (host.ps1 or host.bat), which allows it to intercept and manipulate web browser native messaging.
This rule detects the creation of a file within the SysWOW64 directory followed by an immediate modification or creation of a Windows Run registry key within a 10-minute window. This behavior is indicative of a persistence mechanism where a malicious file is dropped to a system directory and registered for execution at system startup or user logon.
Detects a specific behavioral chain associated with the CHOSEN BRICK implant. This rule identifies when a suspected malicious process writes image/screenshot files (.png, .jpg, .bmp) to disk, followed by a network connection to the Telegram Bot API within a 15-minute window, suggesting potential data exfiltration.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
This rule detects Terraform CLI execution of the 'init' command correlated with network access to HashiCorp AWS registry domains, or the presence of Terraform lock files in specific sensitive or project-related directory paths. This combination often indicates infrastructure-as-code management activities or potential misuse of Terraform in a production environment.
This rule detects the creation, modification, or renaming of files within specific sensitive directories under Local AppData (such as ComponentTask33, INetCache/FilterManager, or Shell/RemoteTempPrimary) that are closely timed with the execution of a PowerShell script named '*_scatter.ps1'. This behavior is indicative of potential malicious staging, data dropping, or modular deployment associated with a specific script-based attack chain.
This rule detects potential data staging activity associated with the REMUS malware. It correlates Windows Management Instrumentation (WMI) queries for antivirus information (e.g., 'AntiVirusProduct', 'WbemLocator') with subsequent file creation events in non-standard directories. This behavior is indicative of an adversary preparing or staging system profile data for exfiltration.
Detects VBScript files that exhibit characteristics of a downloader or dropper, including common Windows API usage (WScript.Shell, Shell.Application, MSXML2.XMLHTTP, ADODB.Stream), staging in the C:\Users\Public\ directory, and performing sandbox evasion via WMI InstallDate checks.
This rule detects potential dropper activity associated with the TrustSink/XHOPLESS threat actor, specifically involving an 'Evernote.zip' file staged in the C:\Users\Public directory. It monitors for the automated extraction of files (like a repurposed notepad++.exe) using VBScript's Shell.Application or WScript.Shell, which is indicative of a side-loading attack chain.
Detects the presence of ZIP archive files masquerading as 'Evernote.zip' that contain 'notepad++.exe', which is a pattern frequently observed in VBScript-based downloaders utilizing binary sideloading to execute malicious payloads.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects a multi-stage malware execution pattern consistent with VelvetCake activity. This includes staging text-based files in C:\Users\Public, downloading PowerShell scripts to temporary directories, executing the script via PowerShell, and subsequently deleting both the staged text files (except for specific allowed filenames) and the payload script.
Detects the installation or execution of virtual camera or synthetic media software followed shortly by the launch of common video conferencing applications on the same endpoint. This behavior may indicate an attempt to inject synthetic video feeds into meetings for impersonation or business email compromise (BEC) attacks.
Detects the execution of wscript.exe or cscript.exe with a command line containing a .vbs file, occurring within a 5-minute window of the creation of a file named 'notepad++.exe' or 'readme.txt' within a sub-directory of 'C:\Users\Public\'. This behavior is indicative of a potential multi-stage execution where a script is used to drop or interact with files in public-accessible folders.
Detects the creation of browser extension files (manifest.json, .crx, .xpi) within the default user profile directories for Google Chrome, Microsoft Edge, and Mozilla Firefox. This behavior is indicative of potential unauthorized browser extension installation, which can be used for persistence or data exfiltration.
Detects a multi-stage attack chain involving the download, extraction, permission modification, and execution of the XMRig cryptocurrency miner on Linux systems. The rule specifically monitors for common staging patterns in /tmp and the use of known mining-related CLI arguments.
Detects a suspicious sequence of events where msiexec.exe is launched by explorer.exe, subsequently spawning a suspended chrome.exe process. This is followed by the creation of a 'PavokwiLoader.exe' file in a 'Temp\modules' directory and the establishment of persistence by setting the 'Load' value within the 'HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows' registry key to execute the dropped loader.
This rule detects a malicious execution chain starting with an MSI file being launched by explorer.exe from user-downloaded folders. The installer spawns chrome.exe, drops a specific loader file (e.g., PavokwiLoader.exe or Loader.exe) into the %LOCALAPPDATA%\Temp\modules\ directory, and establishes persistence via the HKCU 'Load' registry value pointing to that location.
This rule detects potentially malicious activity originating from Microsoft Word (WINWORD.EXE). It monitors for two specific patterns: the creation of script files (.bat, .vbs, .cmd) with GUID-based filenames in non-temp directories, and the creation or execution of files matching known malicious hashes associated with the Hookedge malware family.
Page 27 of 217