Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the Sauron Loader execution chain, which involves a specific process (rnpkeys.exe, rnp.dll, or tdwp.dll) performing a network request (beacon), followed by the creation of a new file (executable, script, or library), and the subsequent execution of that same file. This pattern is characteristic of operator-issued download-and-run tasking.
Detects the Sauron Loader execution chain, which involves a specific process (rnpkeys.exe, rnp.dll, or tdwp.dll) performing a network request (beacon), followed by the creation of a new file (executable, script, or library), and the subsequent execution of that same file. This pattern is characteristic of operator-issued download-and-run tasking.
Detects the Sauron Loader execution chain, which involves a specific process (rnpkeys.exe, rnp.dll, or tdwp.dll) performing a network request (beacon), followed by the creation of a new file (executable, script, or library), and the subsequent execution of that same file. This pattern is characteristic of operator-issued download-and-run tasking.
Detects the creation of files named 'parser.js' or 'loader.js' within hidden or suspicious VSCode directories (e.g., .npm/.vscode/ or AppData/VSCode/). The detection also flags potential signs of malicious intent, such as the existence of a 'package.json' file nearby or the presence of 'tokenapp' in the file path, which are often indicative of the GHAPPIER implant behavior.
This rule detects the creation of multiple suspicious files within the \Windows\Temp\nb_ directory. The monitored filenames, such as 'agent.json', 'pk.der', 'sleepmask.o', and 'core.pak', are highly characteristic of post-exploitation toolkits, specifically those associated with beaconing, shellcode injection, or modular C2 agents. Detecting these files in temporary locations, especially when appearing in combination, strongly indicates potential adversary activity involving the staging and execution of malicious payloads.
This rule detects potentially malicious modifications to package.json files in npm projects or suspicious npm registry telemetry. It flags manifest files containing common obfuscation markers or excessive/unusual dependencies often associated with supply chain attacks, such as crypto, child_process, and common third-party packages frequently used in malicious npm activity.
Detects the creation of 'auth_codes.json' files within directories containing 'seria' in their path. This file is known to be used to store MD5-derived 8-character hex recovery codes for Dahua devices, allowing for password bypass or recovery via the easy4ipcloud.com portal without valid credentials.
This rule detects the creation of XML files matching the 'export_batch_*.xml' naming convention, which is consistent with the output pattern of the Dahua DeviceManager utility. Attackers often use this tool to export camera configuration files containing sensitive credentials (IP, Port, Username, Password). The rule flags activity where multiple such files are created in a short duration, suggesting potential mass exfiltration of camera credentials.
This rule detects Terraform CLI activity interacting with suspicious domains or modules, specifically targeting known repositories or namespaces (e.g., gocommunity.io, gogets.dev). It monitors for Terraform initialization or application patterns referencing these domains in process command lines, as well as the creation of Terraform provider files within these specific namespaces. This behavior is indicative of potential supply chain compromise involving malicious Terraform modules or dependencies.
Detects techniques associated with LSASS process credential dumping, including direct handle access to the LSASS process with specific access masks (common in tools like Mimikatz), the use of rundll32.exe to invoke comsvcs.dll for memory dumping, and the creation of LSASS dump files on disk.
Detects persistence attempts by monitoring modifications to Windows registry run keys (Run, RunOnce, Winlogon Shell/Userinit) or file creation within the Startup folder. It alerts when these locations are updated to reference suspicious file paths (Temp/AppData) or execute scripts (vbs, ps1, js, wsf, bat, hta).
KQL Query
This rule detects the presence of the malicious 'pdf-para-texto@extensao.local' Firefox extension on disk. This extension is known to perform browser-based credential interception by patching the WebAuthn PublicKeyCredential interface at document_start on Google-related domains to facilitate account takeover.
This rule detects the presence of the malicious 'pdf-para-texto@extensao.local' Firefox extension on disk. This extension is known to perform browser-based credential interception by patching the WebAuthn PublicKeyCredential interface at document_start on Google-related domains to facilitate account takeover.
This rule detects the presence of the malicious 'pdf-para-texto@extensao.local' Firefox extension on disk. This extension is known to perform browser-based credential interception by patching the WebAuthn PublicKeyCredential interface at document_start on Google-related domains to facilitate account takeover.
This rule detects potentially malicious activity involving the execution of Node.js scripts initiated by system script proxies (wscript, cscript, msiexec) within specific paths, often associated with subsequent installation of VBScript agents or direct network communication with a known command-and-control IP address.
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
Detects the execution of the RUSTYSHADE Rust-based backdoor, observed during Operation RapidRust, associated with the threat group APT36 (Transparent Tribe). The rule monitors for the specific 'DriverInstaller.exe' filename, known malicious file hashes, and suspicious command-line patterns involving PowerShell-based downloads of 'DriverInstaller.zip' from Backblaze cloud storage.
This rule detects potentially malicious activity involving Node.js modules. It monitors for the deletion of specific 'sharedLoad.min.js' or 'extended' files within 'node_modules' directories, the execution of Node.js processes attempting file deletion operations (like 'unlink' or 'rm') within 'node_modules', and the creation or modification of JavaScript files within 'node_modules' that contain 'btree' references. This activity may indicate an attempt to tamper with application dependencies, inject malicious code, or remove artifacts.
Page 29 of 217