Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of files within the 'ProgramData\output\' directory, a pattern associated with the GigaWiper malware which utilizes this location to store captured screen recordings or screenshots during its operation.
Detects the creation of specific sensitive file names (AGENTS.md, MEMORY.md, IDENTITY.md, USER.md, SOUL.md) within 30 minutes of a process execution containing email-related keywords (email, mail, inbox). This pattern is often indicative of an adversary staging sensitive information for exfiltration after gaining access to or interacting with an email client or communication tool.
Heuristic detection of high-entropy, obfuscated script content consistent with AI-generated (WormGPT-derived) malware formatted specifically to evade AV/EDR detection tooling
Suspicious wermgr.exe Creation Outside System Directory
Detects the creation or modification of a file at a specific Launch Agent path commonly used for macOS persistence. Attackers often place property list (.plist) files in /Library/LaunchAgents/ to achieve persistence across system reboots or user logons.
Detects a process creating files named 'README.TXT' or 'README.txt' across three or more distinct directories. This behavior is a common indicator of ransomware activity, where an adversary drops ransom notes in multiple folders to maximize visibility after encrypting files.
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
This rule monitors DeviceFileEvents to detect the installation of a known malicious browser extension, 'VPN Go: Free VPN'. By matching file activity against the extension's unique ID, this detection helps identify potential browser-based threats, such as information stealer functionality or persistent backdoors installed via malicious extensions.
Detects the presence of known ransomware extortion note file names on endpoints or communication attempts with associated extortion contact email addresses in email logs.
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
Detects the presence or loading of files named 'profiler16.dll' or 'loader-pool.db', which are associated with in-memory payload staging and execution techniques typically used by IDAT (a modular, multi-stage loader).
This rule detects tampering with Microsoft Defender by monitoring registry modifications to Image File Execution Options (IFEO) used to attach debuggers to security processes. It also detects the dropping of the 'kvckiller.sys' kernel driver into System32\drivers, which is associated with disabling security software at the kernel level, and the execution of processes containing 'wsftprm' in the command line.
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects the creation of files within the 'ProgramData\output\' directory, a pattern associated with the GigaWiper malware which utilizes this location to store captured screen recordings or screenshots during its operation.
Detects file creation events with the .candy extension, consistent with the GigaWiper/Crucio-derived BigBang extortion module (BigBangExtortMain, bigBangSingleFileExtortion, bigBangHybridEncryption) which AES-CBC encrypts files using randomly generated, unsaved key/IV pairs across enumerated Windows logical drives before deleting the original file with os.Remove.
Page 89 of 217