Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of a specifically named shortcut (.lnk) file in the Windows Startup directory, a common persistence mechanism used by StealC/ClickFix malware variants.
Detects the presence of the known vulnerable GIGABYTE driver (gdrv.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks to bypass security controls and facilitate kernel-mode execution, as associated with Settra ransomware campaigns.
Detects the creation of shortcut files (.lnk) within the current user's Startup folder using Windows command line utilities or scripts that leverage the WScript.Shell COM object. This behavior is indicative of an adversary establishing persistence to ensure malicious payloads execute upon user logon.
This rule detects potential ransomware activity by correlating three distinct events: the execution of a suspicious, potentially obfuscated binary (matching a specific naming pattern of _win64.exe) from an untrusted location (e.g., Temp, AppData, Downloads), followed by a high volume of file modifications or renames with specific ransomware-related extensions (.locked), and the dropping of a known ransom note file (RESTORE_FILES.txt) within a short 15-minute time window.
Detects execution of processes masquerading as system threads (e.g., [kcached], [rcu_preempt]) that utilize the command-line flag 'exec -a' and include indicators associated with 'gs-dbus' or specific port configurations (GS_PORT=53). This pattern is often associated with obfuscated command-and-control or malicious persistence mechanisms that attempt to hide within common system process names.
Detects modifications or creations of files within the /var/spool/cron directory specifically involving the postgres user, as well as process execution of the 'crontab' utility by or for the postgres user. This activity may indicate an adversary attempting to establish persistence or execute code with postgres privileges.
This rule detects activities associated with suspicious credential dumping and lateral movement tool usage, specifically targeting 'DumpIt.exe' for memory dumping, 'dokan.exe' for potential driver installation, and the creation of known suspicious files like 'memfix.zip' or 'Server.raw'. These actions are commonly indicative of post-exploitation credential harvesting and preparation for exfiltration.
Detects the creation of a hidden file named '.Outlook' within the user's AppData Roaming directory. This behavior is atypical for standard Outlook operations and may indicate malicious activity, such as configuration tampering, persistence mechanisms, or data staging by malware.
Detects concurrent creation of a hexadecimal-named folder in the %TEMP% directory and a corresponding registry key in HKCU\SOFTWARE, both named with the same MD5 hash. This specific behavior is a known indicator of Casbaneiro (also known as Metamorfo) banking trojan infection, where the malware uses these locations to stage components and achieve persistence.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
Detects the creation of files or folders containing suspicious command-line parameters associated with tar or Parallels toolchain injection, specifically looking for the 'use-compress-program' flag which can be abused for command injection.
Detects the creation of files or folders containing suspicious command-line parameters associated with tar or Parallels toolchain injection, specifically looking for the 'use-compress-program' flag which can be abused for command injection.
Detects a suspicious sequence of events where the Parallels Desktop dispatcher service (prl_disp_service) executes a tar command with a compression program flag, followed immediately by the creation or modification of a launch agent (.plist) file in system or user launch directories. This pattern is indicative of exploitation or post-exploitation activity attempting to achieve persistence.
Detects a suspicious sequence of events where the Parallels Desktop dispatcher service (prl_disp_service) executes a tar command with a compression program flag, followed immediately by the creation or modification of a launch agent (.plist) file in system or user launch directories. This pattern is indicative of exploitation or post-exploitation activity attempting to achieve persistence.
Detects high-frequency file creation, opening, or modification events within the Windows AppData Local Temp directory. This behavior, often involving specific obfuscated file names or known malicious process names, is a common indicator of malware payload staging or execution patterns, such as those observed in AsyncRAT infections.
Detects the activity of the PIVOTPIPE .NET loader, which involves writing specific artifacts (core.pak, agent.json, pk.der, or sleepmask.o) to a temporary directory with the 'nb_' prefix or the creation of debug files containing strings associated with in-memory reflective loading of a remote access tool (RAT).
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Detects ROOFDECK backdoor persistence via macOS Launch Agents, tightened to require the implant's distinguishing masquerade artifacts (fake Apple-service drop paths, --type=renderer flag, loginwindow.plist impersonation, or the literal 'persist add|remove|check' CLI syntax) rather than generic LaunchAgents plist creation or launchctl load activity, which legitimate macOS software triggers constantly.
Page 51 of 217