Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects potential web shell creation on a Microsoft Exchange server by monitoring for suspicious child processes spawned by the IIS web server process (w3wp.exe) that correlate with the creation or modification of web-accessible script files (.aspx, .ashx, .asp, .dll) within the Exchange virtual directories (ecp, owa, aspnet_client). This pattern is consistent with common post-exploitation activities used by attackers to gain persistent access via web shells.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule detects the execution, file creation, or registry modification associated with specific ScreenConnect (ConnectWise Control) installation artifacts that align with known suspicious deployment patterns. It monitors for binaries and configuration artifacts that may indicate the unauthorized installation or persistence of remote administration tools.
Detects shell/install scripts that deploy an XMRig-based Monero cryptominer, consistent with the install script planted on the LeakySensey git repository server
This rule detects the creation, modification, or renaming of a browser extension's 'manifest.json' file, which is a critical configuration file for browser extensions. It correlates this file activity with simultaneous or subsequent network requests to common web-based productivity or email services (e.g., Google, Microsoft, Perplexity). This combination of file modification in an extension directory and network activity to sensitive domains may indicate the installation of a malicious browser extension designed for session hijacking or unauthorized data collection.
This rule detects the presence or execution of known files 'winfsp-x64.dll' or 'DukeQt.dll' when located in suspicious, user-writable directories such as AppData, Temp, or ProgramData, while excluding standard system or program installation paths.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects the creation or modification of specific files ('auth_codes.json' or files containing 'seria2') associated with the offline recovery process of Dahua devices. The presence of these files suggests an attempt to utilize or access deterministic recovery codes to bypass authentication on the device.
Detects the presence of the known vulnerable gdrv.sys driver on disk. This driver is frequently utilized in Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode access, which is often leveraged to disable endpoint security products or escalate privileges.
Detects the creation of a .lnk shortcut file within the Windows Startup folder, which is a common persistence mechanism. The detection logic also flags the usage of WScript.Shell and CreateShortcut methods, which are frequently abused by scripts (e.g., VBScript or PowerShell) to programmatically establish this persistence.
Detects the creation of an LNK file in the Windows Startup directory, a common technique used to achieve persistence by executing a specific program or script upon user logon.
Detects instances where processes associated with Claude or Codex modify or create files within a plugin directory without a preceding legitimate installation or session command (such as 'install' or 'plugin add'). This behavior may indicate unauthorized plugin installation, persistence establishment, or malicious code injection into the development environment.
Detects the creation or modification of specific system driver files (nvfsflt64.sys, Alinubx.sys) combined with the installation or initiation of a Windows service associated with NVIDIA filter names. This behavior is often indicative of persistence mechanisms, potential rootkit activity, or the deployment of vulnerable drivers (BYOVD).
This rule detects potential malware delivery by correlating network visits to known malicious domains used for lure distribution with subsequent large file downloads (.zip files >= 100MB) in typical user download or temporary folders within a short time window. This pattern is characteristic of campaigns leveraging social engineering and file-based evasive techniques (such as padding to bypass static analysis) to distribute malicious payloads.
This rule detects the presence of files and folders associated with the Rapuncel infostealer malware. It monitors DeviceFileEvents for specific SHA256 hashes known to be malicious, as well as specific file names related to data exfiltration and log collection (e.g., 'browser_decryption.log', 'sends.log'), and the creation of files within folders containing 'Filegraber'.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
Detects the creation of .iso or .zip files on Windows user directories (Desktop/Downloads) or with suspicious filenames potentially associated with phishing delivery methods.
Detects the creation of a specific JSON file named 'uploaded_files.json' within a 'SmartUploader' directory by PowerShell. This behavior may indicate an automated process, script, or actor staging data for exfiltration or managing uploaded content via PowerShell.
This rule detects potentially malicious activity by monitoring for file creation events within a specific 'FitnessPrograms' directory path and the execution of suspicious processes containing keywords related to command-and-control-like behavior (e.g., 'download_and_execute', 'checkCoachInstructions').
Detects the creation of hard links on a Windows system using utilities such as mklink or fsutil. Specifically, this rule identifies scenarios where a malicious executable located in %APPDATA% is linked to a backdoor binary stored in C:\ProgramData\, a technique used by adversaries to mask the true file path and evade security controls or detection mechanisms.
Page 45 of 217