Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects BeaverTail JavaScript-based loader malware hidden inside NPM packages, distributed via GitHub or Bitbucket during fake technical interviews
Detects file and process activity associated with the Hermes ransomware, specifically targeting the presence of 'SOUL.md' files, '.hermes' file paths, and the 'HERMES_DISABLE_SAFETY=1' command-line argument.
Detects the creation of a 'manifest.json' file within a directory path containing 'Extensions' by common web browsers, followed by an immediate file access event from a non-standard browser location within one hour of the installation. This pattern is indicative of the installation of a potentially malicious or sideloaded browser extension followed by anomalous file activity.
Detects the creation or modification of a browser extension 'manifest.json' file that requests both 'declarativeNetRequest' and 'contentScripts' permissions. These permissions are frequently associated with browser-based session hijacking, traffic redirection, and unauthorized data injection, common in malicious extensions.
Detects the installation of a rogue root certificate into the operating system's trust store. This is a common technique used by adversaries to perform TLS/SSL interception (Adversary-in-the-Middle) by establishing a chain of trust for malicious proxy traffic. The rule identifies suspicious use of Windows 'certutil' to add certificates to the 'Root' store, macOS keychain certificate management commands, and indicators associated with 'Localcertificate.zip' payloads.
Detects components associated with the SparroWocky trident loader, specifically targeting side-loaded DLLs (DukeQt.dll or winfsp-x64.dll) and .dat data containers that contain a specific magic value (0x11328712) and RC4 strings, indicating in-memory payload decryption and mapping.
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
Detects DLL side-loading of 'winfsp-x64.dll' or 'DukeQt.dll' by legitimate signed executables from non-standard directories. This behavior is associated with the FamousSparrow threat actor's 'SparroWocky' trident loader scheme, which leverages side-loading to execute malicious payloads in the context of trusted processes.
Detects unauthorized modifications, creations, or renames of Pluggable Authentication Module (PAM) configuration files or core shared libraries (such as pam_rootok.so or pam_permit.so) by non-root users. Attackers often modify these files to bypass authentication mechanisms and achieve privilege escalation. The rule excludes common package management tools to minimize false positives.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
This rule detects file creation or modification events occurring within the 'ProgramData\ZlibDate' directory. This specific path and the associated file extensions (.Dat and .zip) are frequently associated with data staging activities or unauthorized file management by malicious software attempting to persist or exfiltrate data under the guise of legitimate application data.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
Detects the installation or modification of a browser extension (manifest.json file creation) followed by network activity from the browser to trusted AI assistant domains within a five-minute window. This behavior is indicative of potentially malicious browser extensions or content scripts being introduced to intercept or manipulate user interaction with AI services.
Detects the installation or modification of a browser extension (manifest.json file creation) followed by network activity from the browser to trusted AI assistant domains within a five-minute window. This behavior is indicative of potentially malicious browser extensions or content scripts being introduced to intercept or manipulate user interaction with AI services.
Detects the installation or modification of a browser extension (manifest.json file creation) followed by network activity from the browser to trusted AI assistant domains within a five-minute window. This behavior is indicative of potentially malicious browser extensions or content scripts being introduced to intercept or manipulate user interaction with AI services.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects the 'Comet.exe' process, associated with the Perplexity Comet AI agent, accessing sensitive system files or configuration directories outside its expected scope. This pattern of file interaction is characteristic of unauthorized data collection or exfiltration attempts, specifically linked to the BragJack threat activity.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects network communication with identified C2 infrastructure associated with VectraRAT, Amadey, and ClickFix campaigns, as well as the presence of a specific 'callback.json' artifact in temporary directories, which is commonly used for C2 address overrides.
Detects the creation or modification of a property list (.plist) file within the /Library/LaunchAgents/ directory on macOS. The rule filters for configurations set to execute at system load, and identifies instances where the program path executed by the launch agent does not reside in standard, trusted system directories. This behavior is indicative of potential persistence mechanisms utilized by malware or unauthorized background processes.
Page 50 of 217