Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects unauthorized access, creation, modification, or deletion of the 'passkey_enclave_state' file within the Google Chrome user data directory by processes other than 'chrome.exe'. This file contains sensitive cryptographic material related to Chrome's synced passkey cloud authenticator, and non-browser process interaction with it is indicative of potential credential theft or passkey exfiltration (e.g., 'Golden/Silver Pass-ta-key' attacks).
Detects non-browser, non-password-manager processes accessing browser process memory (potential in-memory cookie theft), copying browser credential/cookie database files (Login Data, Cookies, Local State, key4.db, logins.json), or enumerating stored Wi-Fi profile keys via netsh wlan show profile key=clear - behaviors associated with CornFlake RAT credential theft and Wi-Fi credential harvesting used in the CaptiveCrunch campaign.
Detects the ChainDrop/Shai-Hulud 2.0 "Run Copilot" secrets-laundering technique: a CI workflow step dumping toJSON(secrets) to a format-results.txt artifact, followed by GitHub Actions artifact-API downloads using scraped ghs_ runner tokens and git ref deletion used to cover tracks.
Detects the execution of the LimeWire P2P file-sharing application within 30 minutes of the creation of sensitive files, such as LSASS memory dumps, NTDS.dit, or SAM/SYSTEM/SECURITY registry hives, on the same host. This temporal correlation suggests the potential exfiltration of sensitive credential material via P2P file-sharing.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects creation of a VS Code/Open VSX extension folder whose name reuses a known legitimate vendor namespace (AMD, Azure, Salesforce, Hyperledger, LEGO Education, IOTA, US government) but is published at an implausibly low version (0.0.1 or 0.0.2), matching the 'evil twin' extension-confusion pattern.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
Detects the creation of files named 'svchost.exe' within user Documents directories, excluding files located in 'C:\Windows\System32'. This rule identifies potential file masquerading, a tactic often used by adversaries to hide malicious binaries within legitimate system process names during post-exploitation activities.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
Detects a VBS script invoking PowerShell to decode a Base64 payload, write it to disk with a random name, and decompress it using IO.Compression.GzipStream into tmp*.bat.gz/tmp*.bat files, consistent with the AutoIT-based VIPKeylogger/MedusaHVNC infection chain.
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects macOS persistence via launchctl loading a LaunchAgent plist within 300 seconds of that plist file being created in /Library/LaunchAgents/, a technique associated with the DOUBLECUP loader delivering CountLoader and DeviceManager RATs.
Detects creation of a .lnk file on a removable/non-system drive letter (D: through Z:) whose launching process command line references mshta.exe, consistent with CountLoader's USB-worming propagation technique observed in the DOUBLECUP LaaS campaigns.
Detects the creation of a file named 'license.tmp' within the '/var/tmp/' directory. This location and filename pattern is often associated with the staging or execution of temporary files, potential persistence mechanisms, or obfuscated payloads commonly found in Linux-based malware or adversary activity.
Detects file creation, modification, or rename activity targeting known directory paths and files used by the AMOS (Atomic macOS Stealer) to stage exfiltrated credentials, cryptocurrency wallets, and browser data. It identifies staging activity by looking for patterns associated with the stealer's data-collection routines.
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
Page 83 of 217