Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of tar archives within the Coder database during a specific window associated with rogue IP activity, where the file creation was performed by a system-level process.
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects anomalous activity patterns consistent with automated firmware reverse engineering pipelines, specifically correlating the high-frequency execution of firmware analysis tools (e.g., binwalk, Ghidra) with the creation of vulnerability research knowledge base artifacts. This behavioral heuristic aims to identify potential AI-driven or automated zero-day discovery workflows by tracking tool usage density and output characteristics.
This rule detects modifications or creation of files named 'crond' in standard system paths ('/usr/bin' or '/usr/sbin') that occur within a 4-second window of an 'ssh' binary file event. This pattern is indicative of potential persistence establishment where an adversary replaces or modifies a system daemon while simultaneously interacting with SSH services.
Triggers on any Sysmon "FileExecutableDetected" event, which triggers every time a PE that is monitored by the config is created.
This rule detects the presence of 'winpty-agent.exe' or 'winpty.dll' in proximity to 'node.zip' or 'build.zip' files within common user-writable or temporary directories ('AppData\Local\Temp', 'AppData\Roaming', 'ProgramData', 'Users\Public'). This pattern is often associated with the staging and execution of malicious tools or command-line wrappers in non-standard locations, bypassing legitimate application installation directories.
Detects a suspicious sequence of activities where PowerShell downloads or extracts specific zip files (node.zip, build.zip) to staging directories, followed by the execution of associated binaries like node.exe, winpty-agent.exe, or winpty.dll from those same locations. This behavior is indicative of an adversary staging and executing tooling within temporary user directories.
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
This rule detects the execution of potentially malicious files (executables, scripts) from user-writable directories (Downloads, AppData, Desktop) where the file appears to be related to a ZIP archive recently downloaded or extracted by an archive handler or browser. It correlates process execution events with file creation events from ZIP archives to identify potential user-execution of malicious payloads delivered via ZIP files.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects the execution of an unsigned 7z.exe that loads an unsigned 7z.dll from a public, user-writable directory (C:\Users\Public\Documents). The rule specifically looks for the creation of the DLL shortly before it is loaded, indicating potential DLL side-loading to bypass security controls using a renamed or modified archive utility.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects the creation or modification of crontab files, as well as the execution of crontab commands, that involve suspicious paths (e.g., /tmp, /var/tmp, /dev/shm, hidden files) or command obfuscation techniques such as base64 encoding. This behavior is often associated with the establishment of persistence by adversaries.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects a suspicious sequence of events involving the execution of 'setup.sh', the subsequent creation of a hidden file in temporary directories, and the deletion of specific architecture-named files (redtail.*). This behavior is indicative of a malware loader or droppers attempting to install and then remove traces of its components.
Detects anomalous SSH sessions originating from potentially suspicious IP addresses that utilize an 'SSH-2.0-Go' banner and immediately perform file creation operations associated with the RedTail botnet (e.g., shell scripts or architecture-specific binaries).
Detects the creation of PHP files within the 'wp-content/uploads/elementor/forms/' directory of a WordPress installation. This behavior is highly suspicious as it often indicates an attempt by an attacker to deploy a web shell or other malicious script following successful exploitation of the Elementor plugin, which allows for arbitrary file uploads.
This rule monitors for two distinct indicators of compromise: it detects the execution of files dropped into specific patterns within the 'AppData\Roaming' directory (associated with potential GoCaracal malware) and identifies network connections to known C2 infrastructure associated with GoCaracal and Bandook malware families.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
Detects the presence of small PHP files containing both PHP execution tags and path traversal sequences. This pattern is indicative of a web shell or malicious script placed outside of intended directories via path traversal exploitation.
Page 71 of 217