Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects rundll32.exe executing a DLL located in a user-profile directory (Users, AppData, or Documents and Settings) shortly after that same DLL file was created or written, consistent with CountLoader's taskType 3 DLL delivery and execution behavior.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects file staging activity by AppVShNotify.exe, the legitimate App-V binary abused by NightLedger via DLL search-order hijacking. NightLedger's C2 command dispatcher supports Command ID 20 (download file), Command ID 27 (copy file), and Command ID 62 (delete file), which manifest as file create/delete activity performed by this hijacked host process. To reduce noise from genuine App-V client operation, the rule fires either when AppVShNotify.exe is observed loading the rogue SspiCli.dll (the sideloaded hijack DLL) or when the process performs file create/delete activity against paths outside the standard App-V cache/staging directories.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects a browser process (chrome.exe, msedge.exe, firefox.exe, brave.exe) writing a new, previously-unseen executable to a Downloads/Temp/Cache path and then launching that same executable within minutes — the terminal behavior of SourTrade's in-browser malware assembly pipeline, consistent with local execution of the JSCEAL (WeevilProxy) stealer payload.
Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.
Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.
Detects instances where Microsoft Edge (msedge.exe) initiates a python.exe process that executes 'native_host.py' (associated with the Edgecution malware suite) and subsequently writes files to sensitive or non-standard directories such as ProgramData or Edge recovery folders. This activity is indicative of the malware's native messaging host persistence, staging, or data exfiltration mechanisms.
Detects the CornFlake RAT masquerading as 'svchost32.exe' executing from within user AppData directories. The rule correlates the initiation of audio/video capture APIs (WASAPI or MediaFoundation) by this process with the subsequent creation of .wav, .jpg, or .jpeg files, suggesting unauthorized audio or camera capture by the malicious process.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Detects persistence mechanisms involving the modification or creation of Windows Registry Run keys or the placement of executables/shortcuts in the Windows Startup directory. The rule specifically targets binaries located in user-writable directories (Temp, AppData, Downloads) that are either unsigned or lack a signature from trusted publishers, while excluding known legitimate system and third-party application paths.
Detects unauthorized file write operations to Group Policy Object (GPO) startup script paths or suspicious GPO configuration files. This behavior is associated with the TOKYOCORE ransomware, which uses GPO modification as a mechanism for persistence and domain-wide propagation of malicious payloads via startup scripts.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Detects a suspicious pattern where a process creates a file in /dev/shm/, unlinks it, and re-executes itself from /proc/self/fd/ while manipulating the process name to masquerade as the systemd-journald daemon. This behavior is indicative of fileless execution techniques used by malware to maintain a presence while blending in with legitimate system processes.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
Detects the specific combination of persistence mechanisms employed by TOKYOCORE ransomware, which uses redundant Windows autostart techniques including registry run keys, boot execution commands, and startup folder file drops. The rule specifically monitors for masqueraded 'WindowsUpdate' and 'bootexec.bat' naming conventions.
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Page 84 of 217