Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,459
11,842
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule performs a two-layer hunt for the ShieldBreak/RoguePlanet (CVE-2026-50656) exploit. Layer 1 detects potential privilege escalation by identifying Windows Error Reporting processes (WerFault, WerFaultSecure, or WerMgr) running as SYSTEM that initiate suspicious child processes like cmd.exe, powershell.exe, or rundll32.exe. Layer 2 identifies the presence of known exploit artifacts including 'ShieldBreak.exe', 'Warden.dll', and the 'eicar_com.zip' test file via process execution or file creation events.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
Detects the use of the Windows 'copy /b' command to reconstruct a potential binary payload from smaller components, specifically targeting the creation of an executable named 'Windowsupdate.exe'. This technique is often used to bypass security controls by splitting malicious files into smaller pieces that do not trigger static analysis signatures.
This rule detects activities associated with the C2Looper v2 backdoor, which achieves persistence and code execution by sideloading a malicious wtsapi32.dll into the OneDrive process. It also identifies subsequent beaconing behavior where the compromised OneDrive process communicates with GitHub-hosted infrastructure to exchange command and control state files (cmd.json, result.json, beacon.json) instead of using traditional dedicated C2 servers.
This rule detects the creation of files with specific names '8bfa.zip' or '8bfa.bin' within the Windows AppData Local Temp directory. This behavior is indicative of a threat actor staging payloads or tools on a compromised system, typically as a precursor to execution or lateral movement.
Detects the creation of .plist files in sensitive directories used by macOS launchd for automatic execution (LaunchAgents and LaunchDaemons). Adversaries use these locations to establish persistence by ensuring malicious code or scripts are executed at startup or upon user login.
This rule Hunts Microsoft Defender for Endpoint DeviceFileEvents for .aspx/.ashx/.asmx files created by w3wp.exe (the IIS worker process) inside SharePoint-specific directories (wss\VirtualDirectories, Web Server Extensions, TEMPLATE\LAYOUTS, App_Code, App_Web, \bin\) — a classic webshell-drop pattern used once an attacker has already gained code execution on the server. It excludes benign SYSTEM/TrustedInstaller writes of default.aspx/upgrade.aspx to cut noise from normal patching/upgrade activity. This is a post-exploitation signature — it doesn't detect the exploit itself, only the artifact an attacker typically drops afterward.
CVE-2026-63520 An unauthenticated remote-code-execution flaw in SharePoint Server's Business Connectivity Services, caused by unsafe .NET type instantiation, disclosed jointly by Rapid7 and Microsoft. It lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It's the second half of a two-part chain — combined with the earlier CVE-2026-55040 (disclosed the prior month), it enables full unauthenticated RCE. As of disclosure there was no public PoC and no observed exploitation, though Microsoft rated it "exploitation more likely," and CVSS attack complexity is high, meaning reliably chaining both CVEs takes real effort.
Since no exploitation artifacts for this CVE chain are public yet, this rule is a generic SharePoint webshell hunt tagged to the CVEs for tracking -- it's not a signature of the BCS exploitation primitive itself.
CVE-2026-63520 An unauthenticated remote-code-execution flaw in SharePoint Server's Business Connectivity Services, caused by unsafe .NET type instantiation, disclosed jointly by Rapid7 and Microsoft. It lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It's the second half of a two-part chain — combined with the earlier CVE-2026-55040 (disclosed the prior month), it enables full unauthenticated RCE. As of disclosure there was no public PoC and no observed exploitation, though Microsoft rated it "exploitation more likely," and CVSS attack complexity is high, meaning reliably chaining both CVEs takes real effort.
Since no exploitation artifacts for this CVE chain are public yet, this rule is a generic SharePoint webshell hunt tagged to the CVEs for tracking -- it's not a signature of the BCS exploitation primitive itself.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
This rule detects suspicious file system activity (creation, modification, or renaming) performed by the ESET Remote Administrator (ERA) Agent process, excluding files within standard ESET installation and ProgramData directories. This behavior may indicate an adversary attempting to leverage the legitimate ERA agent to perform unauthorized file operations or masquerading as the agent.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
This rule detects PowerShell commands that programmatically create a Windows shortcut (.lnk file) targeting a startup folder or mimicking Windows update processes. This behavior is indicative of an adversary attempting to establish persistence by creating a shortcut that executes a malicious script or binary upon user login or system startup, often associated with the QUICSILVER campaign.
Detects the creation, modification, or renaming of systemd service files within a user's configuration directory (~/.config/systemd/user/). The rule further correlates these file events with the execution of 'systemctl --user' commands to enable or start these services, which is a common pattern for establishing user-level persistence on Linux systems.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Detects creation of a mandatory profile hive (NTUSER.MAN) matching the size produced by the RegLoadAppKeyW -> ORCreateKey/ORSetValue/ORSaveHive offreg.dll API sequence used to forge an offline registry hive for persistence, as observed with the TWINLOOT Python implant. TWINLOOT builds the offline hive via offreg.dll (RegLoadAppKeyW, ORCreateKey, ORSetValue, ORSaveHive) with Run key or COM hijack values baked in, then writes it to %USERPROFILE%\NTUSER.MAN so Windows loads it in preference to NTUSER.DAT at the next user logon, achieving persistence with no registry events, no admin privileges, and no visibility to standard tooling. Tightened to exclude the process image when it is a known legitimate profile-management or provisioning tool (USMT, SCCM, Intune Management Extension) that also uses offreg.dll to build NTUSER.MAN during normal mandatory/roaming profile deployment.
Detects the creation of a file named 'c2_out.txt' in common temporary or user directories ('\Users\', '\Temp\', or '\AppData\') shortly after a 'cmd.exe' process execution on the same device. This behavior is indicative of a potential command-and-control (C2) activity where output from malicious shell commands is being saved to a file.
This rule detects the use of the Windows 'copy /b' command to reconstruct an executable file (named Windowsupdate.exe) by concatenating two separate files ('header.doc' and 'body.doc'). This behavior is consistent with file-based reconstruction techniques used to bypass security controls by splitting payloads into seemingly benign components.
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
Detects the creation or renaming of a file named 'pld.exe' within the AppData Local directory. This path is frequently used by malware to masquerade as legitimate applications and establish persistence while avoiding scrutiny.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
Page 79 of 217