Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects unauthorized or suspicious file access, modification, or creation events targeting sensitive web browser data files, including login credentials, saved passwords, and browser cookies. These files are prime targets for information-stealing malware attempting to harvest sessions or authentication data.
Detects the creation of an LSASS memory dump file (lsass*.dmp) initiated by Task Manager (taskmgr.exe) within Temp or user directories. This behavior often indicates an adversary or unauthorized user leveraging the Task Manager 'Create dump file' feature to dump process memory for credential harvesting.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Double extension masquerading is a defense-evasion technique (cataloged under MITRE ATT&CK T1036.007) where a malicious executable file is disguised with a safe-sounding first extension, such as .pdf.exe or .jpg.scr , etc, to trick users into opening it.
This rule is used to detect suspicious double Extension Masquerading
This rule is used to detect suspicious double Extension Masquerading
Detects post-exploitation persistence artifacts on Windows endpoints managed by N-able N-central consistent with abuse of CVE-2026-18577, including a new Windows service named Cloudflared, registry Services key creation for Cloudflared, a file named svchost.exe written under a user's Documents folder, or process execution of cloudflared.exe or a Documents-located svchost.exe.
This rule detects potential attempts to exploit kernel vulnerabilities related to the Stream Control Transmission Protocol (SCTP) within a containerized environment, followed by suspicious file creation activity in sensitive system directories (e.g., /root/). It correlates logs showing SCTP socket configuration activity with subsequent filesystem modifications within a short 5-minute window.
This rule detects file creation and process execution events involving strings associated with the Solidity-Pro tool, which is known to be used as a C2 mechanism or malicious component. It specifically triggers on files with these patterns and processes spawned by or related to 'Code.exe' (VS Code) utilizing these malicious strings in their command lines.
This rule detects activities associated with the SHub Stealer malware on macOS, specifically identifying the creation of staging directories in /tmp (named /tmp/shub_<id>/*), the presence of a 'FileGrabber' sub-directory, and unauthorized file access to common cryptocurrency wallet applications like Electrum, Exodus, Trezor Suite, Ledger Live, Sparrow, and Guarda. It filters out common administrative or installer tools to reduce noise.
Detects the execution of FTK Imager.exe followed by the creation of the Active Directory database (NTDS.dit) and at least one critical Windows registry hive file (SAM, SYSTEM, or SECURITY) in the user's Downloads folder within a 30-minute timeframe. This pattern is indicative of potential credential theft or offline password cracking attempts using forensic imaging utilities.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects msiexec.exe executed with silent installation flags (/i /quiet /qn) targeting an MSI file that was written to disk within the preceding 15 minutes, consistent with the CountLoader delivery chain associated with DOUBLECUP.
Detects the UAC self-elevation behavior associated with DeadLock ransomware, specifically the repeated creation and execution of randomly named 8-character .cmd files in user-writable directories (Temp, ProgramData, AppData). The detection triggers when multiple execution attempts are identified within a short window, suggesting a retry loop when UAC prompts are not immediately accepted.
This rule monitors file events to detect the presence of known malicious npm packages identified in a supply chain attack. It specifically checks for files created or modified within 'node_modules' directories that match a predefined list of malicious package names.
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects non-browser, non-password-manager processes accessing browser process memory (potential in-memory cookie theft), copying browser credential/cookie database files (Login Data, Cookies, Local State, key4.db, logins.json), or enumerating stored Wi-Fi profile keys via netsh wlan show profile key=clear - behaviors associated with CornFlake RAT credential theft and Wi-Fi credential harvesting used in the CaptiveCrunch campaign.
Page 82 of 217