Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects anomalous activity patterns consistent with automated firmware reverse engineering pipelines, specifically correlating the high-frequency execution of firmware analysis tools (e.g., binwalk, Ghidra) with the creation of vulnerability research knowledge base artifacts. This behavioral heuristic aims to identify potential AI-driven or automated zero-day discovery workflows by tracking tool usage density and output characteristics.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.
Detects the creation of specific Object Manager namespace directories and objects used by the ShieldCrash proof-of-concept (CVE-2026-69414) to hijack the Microsoft Defender scan process.
Detects the creation of specific Object Manager namespace directories and objects used by the ShieldCrash proof-of-concept (CVE-2026-69414) to hijack the Microsoft Defender scan process.
Detects the creation of specific Object Manager namespace directories and objects used by the ShieldCrash proof-of-concept (CVE-2026-69414) to hijack the Microsoft Defender scan process.
Detects presence of multiple ShieldCrash CVE-2026-69414 PoC Visual Studio project/solution build artifacts indicating exploit tooling staging
Detects high-frequency file creation, modification, or renaming activity involving files with the specific '.df_win' extension, likely indicative of mass encryption activity or automated ransomware behavior. The rule excludes known backup and security software processes to reduce noise.
This rule detects potential COM hijacking of the CLSID InprocServer32 registry keys or unauthorized loading/creation of the 'EhStoreShell.dll' file. These behaviors are common indicators of persistence mechanisms or DLL side-loading where attackers redirect legitimate system calls to malicious code.
This rule detects potentially malicious behavior associated with Microsoft Office applications, such as Word, initiating suspicious WebDAV network connections, dropping executable or sensitive files, or spawning known LOLBAS processes (rundll32, explorer, regsvr32) from suspicious directories like Temp or WebDAV paths. It also includes a blocklist for known malicious file hashes associated with these patterns.
Detects execution, file writing, or network activity associated with the process named 'Stella_Gary', which may indicate the retrieval or use of malicious plugin modules.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects the execution of 'OrionQuests-Setup.exe' followed by the creation of a shortcut (.lnk) file by the same process. This activity is a known indicator of the Kimsuky (APT-C-55) Stella_Gary infection chain, where a disguised installer drops malicious shortcuts to facilitate further execution.
Detects the execution or creation of files masquerading as Mozilla Firefox components (e.g., firefox.exe) located within non-standard, suspicious directories under 'ProgramData'. The rule further refines these alerts by identifying instances where the file lacks a valid Mozilla digital signature or contains an incorrect company name in its metadata.
Detects the placement of potentially malicious executable or script files onto a network share followed by the execution of that specific file path from a different host within a short timeframe. This behavior is indicative of lateral movement using tainted shared content.
Page 59 of 217