Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects instances where the Greenshot.exe application loads DLLs (log4net.dll, GreenshotPlugin.dll, LinqBridge.dll) from locations outside of the expected installation directory ('\Program Files\Greenshot' or '\Program Files (x86)\Greenshot'). The rule also tracks the creation of configuration or updater files ('greenshot-defaults.ini', 'updater.bat') which may be indicative of unauthorized modification, persistence, or potential DLL side-loading attempts.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Detects bulk insertions or content updates into vector databases, document stores, or knowledge bases that contain suspected instruction-override, jailbreak, or role-hijacking phrases, particularly when performed by unauthenticated or unknown identities.
Detects bulk insertions or content updates into vector databases, document stores, or knowledge bases that contain suspected instruction-override, jailbreak, or role-hijacking phrases, particularly when performed by unauthenticated or unknown identities.
Detects unauthorized modifications to AI agent configuration files, including system prompts, tool allow-lists, and MCP server registration files. Such changes are often performed by processes outside of approved configuration management or infrastructure-as-code pipelines, potentially allowing for persistent manipulation of AI model behavior and capabilities.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Detects bulk insertions or content updates into vector databases, document stores, or knowledge bases that contain suspected instruction-override, jailbreak, or role-hijacking phrases, particularly when performed by unauthenticated or unknown identities.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects activity associated with the CARBONATO botnet utilizing the GH0ST RAT agent to locate, stage, and exfiltrate sensitive AI API keys. The detection monitors for file write operations within specific hidden directories ('/root/.hermes/loot/') and the use of malicious command-line patterns or process context associated with Hermes Agent or GH0ST malware to search for configuration files (e.g., .env) containing sensitive API credentials.
Detects EDRKiller.exe or WarsawKiller.exe binaries and the associated wsftprm.sys BYOVD driver used by The Gentlemen threat actor to terminate security product processes
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
This rule detects potential privilege escalation exploiting a dangling COM object registration (CLSID {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}). It monitors for a non-SYSTEM user creating a DLL within the 'CrossDevice' ProgramData folder, followed by a scheduled task trigger, and subsequently detects 'dllhost.exe' running as SYSTEM loading that specific malicious DLL, indicating successful execution of unauthorized code with elevated privileges.
Detects the presence of known Vidar infostealer samples by matching file hashes against a list of identified malicious artifacts. The rule monitors for file creation events, process execution (both as the primary process and as an initiating process), and network activity originating from these known malicious files.
Detects the presence of known Vidar infostealer samples by matching file hashes against a list of identified malicious artifacts. The rule monitors for file creation events, process execution (both as the primary process and as an initiating process), and network activity originating from these known malicious files.
Detects the presence of known Vidar infostealer samples by matching file hashes against a list of identified malicious artifacts. The rule monitors for file creation events, process execution (both as the primary process and as an initiating process), and network activity originating from these known malicious files.
Detects the drop and execution of the AvisLoader rootkit component, hmn_hook.dll. The rule identifies suspicious file drops in non-standard, user-writable directories (e.g., AppData, Temp) that are not associated with legitimate installers, as well as the loading of unsigned or non-Microsoft-signed versions of the DLL accompanied by hook-related process arguments such as HMN_HideStart or NtQuerySystemInformation.
Page 32 of 217