Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects instances where a web browser accesses a domain listed in the 'AdFection_Domains' watchlist, followed closely by the browser spawning a script interpreter (such as PowerShell, wscript, cscript, mshta) or dropping an executable/script file in user profile or temporary directories.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects web server processes writing PHP files into sensitive WordPress directories (such as mu-plugins or rank-math-pro/includes) shortly after deleting them within a 1-hour window. This behavior often indicates the rebuilding or updating of a webshell or backdoor for persistence.
Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.
Detects the creation or modification of web script files (.aspx, .jsp) within common web application directories by unusual processes (such as command shells or download utilities) or by non-standard user accounts, indicating potential web shell deployment.
Detects a PowerShell download-and-execute command referencing specific typosquatted lure domains (e.g., choclatey.org, massgravel.net) combined with follow-up script activity writing into a fake SystemHealth\Update directory.
Detects suspicious process execution where a shell or scripting tool is spawned by the nsppe process or running under the nobody account, followed closely by file creation or modification activity in persistence locations or NetScaler GUI web directories.
Detects script files (PHP, JSP, etc.) created or renamed within web root directories by the ProFTPD process, indicating potential exploitation of the mod_copy module (CVE-2015-3306) to upload web shells.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
The following analytic identifies the creation of executables or scripts in temporary file paths on Windows systems. It leverages the Endpoint.Filesystem data set to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in temporary directories (e.g., \windows\Temp\, \AppData\Local\Temp\).
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
This activity can be significant as adversaries often use these paths to evade detection and maintain persistence.
If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects anomalous activities associated with potential PHP2Shell exploitation or webshell deployment where a web server worker (such as Apache, HTTPD, or PHP) spawns a Unix shell containing suspicious utility tokens, drops a PHP file outside excluded directories, or creates a PHP session-derived file.
Detects the writing and subsequent loading of driver files signed by a specific certificate holder (Wenjiang District Mingyu Network Technology), utilizing DeviceFileCertificateInfo, DeviceFileEvents, and DeviceImageLoadEvents.
Detects instances where inst.exe running from C:\ProgramData\Intel with specific command-line arguments (extensionless and key-like) subsequently writes files to the EFI system partition or boot paths on the same device.
Correlates the modification of the Explorer Policies Run registry key (specifically the 'Loader' value) with the creation or modification of a .url shortcut file in the user Startup folder on the same device within a 1-hour window, using the same initiating process.
Detects potential SafePay ransomware activity by correlating mass file encryption (.safepay extension) with the creation of potential ransom notes and subsequent self-deletion of the encrypting process.
Detects the creation or modification of Windows provisioning packages (.ppkg) by processes other than expected provisioning and servicing tools. Attackers, such as those utilizing the Sirius Backdoor, can abuse custom .ppkg files to maintain persistence across OS resets.
Detects a sequence of suspicious behaviors on a single device within a 4-hour window: web shell file creation by a web server process, subsequent credential extraction or dumping tooling execution (such as accessing LSASS, NTDS, or SAM), and enumeration of installed security software or endpoint sensors.
Detects the staging of wmpdmc.exe and wmpdui.dll together within a ProgramData folder, as well as subsequent scheduled task creation or execution of wmpdmc.exe from ProgramData associated with the Yoba campaign.
Detects artifacts and execution patterns associated with the Yoba campaign involving fake AI applications (such as ChatGPT, Claude, Codex) containing malicious setup files, sideloaded DLLs (winmm.dll, wmpdui.dll), and cryptocurrency miners (XMRig).
Detects creation of a DLL inside a camera management software
installation directory under Program Files. The campaign dropped malicious DLLs
alongside the trusted vendor binary so that the signed camera client side-loads
them at startup, proxying execution through a legitimate vendor process
(T1574.002 / T1036.005).
installation directory under Program Files. The campaign dropped malicious DLLs
alongside the trusted vendor binary so that the signed camera client side-loads
them at startup, proxying execution through a legitimate vendor process
(T1574.002 / T1036.005).
Page 3 of 217