Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of PNG screenshot files with a specific directory naming convention (numeric subdirectory containing numeric filename) associated with the GigaWiper destructive malware.
Detects the creation or modification of a specific macOS plist file ('com.apple.crashreporter.helper.plist') within the '/Library/LaunchAgents/' directory, correlated with a file event occurring in '/Library/Caches/' within a one-hour window. This behavior is indicative of an adversary attempting to establish persistence by impersonating a legitimate Apple system process and utilizing cache directories to host malicious payloads.
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Detects potential screenshot activity by monitoring the creation and subsequent deletion of .png image files by the pythonw.exe process, a pattern observed in Starland RAT post-compromise activity.
Detects the creation or registration of scheduled tasks involving the suspicious artifact 'SolidPDFPcl2Bmp'. This monitoring covers process executions using schtasks.exe or reg.exe, registry modifications to the Windows Task Scheduler cache, and file drops within the Windows System32 Tasks directory, which are common indicators of persistence establishment via scheduled tasks.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detects the creation of SQLite database files associated with the LabubaRAT malware implant. The rule monitors for the nvidia-sysruntime.exe process creating specific database files (nvctr_sys.db and its associated journal/shared memory files) which are used for staging collected data.
Detects unauthorized creation or modification of persistent-state files used by AI agents (e.g., AGENTS.md, MEMORY.md). Such files can be poisoned to manipulate the AI agent's objective knowledge or behavior if the content is sourced from untrusted external inputs like email rather than explicit user instructions.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
Detects new file creation or modification events within the /Library/Caches/ directory of user profiles on macOS. Adversaries may utilize these directories for persistence, staging, or hiding malicious payloads.
Detects DLL files planted in application directories for execution flow hijacking
Detects dropped builder/README/config files from underground Ransomware-as-a-Service kits bundling FUD AES-256 crypters, private stubs, decrypters, and key generators for Windows 10/11 ransomware payloads
Detects the creation of specific image files (e.g., .png, .bmp) at the root of the system drive (C:\). This behavior is associated with certain ransomware strains (such as NoEscape) that stage files with misleading extensions in unusual locations to evade detection.
Detects presence of known-malicious Jscrambler npm supply chain dropper artifact filenames dist/setup.js and dist/intro.js referenced or embedded within scanned content (package contents, tarballs, manifests)
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
This rule monitors for the creation or modification of specific files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) that often mimic agent-based collection or configuration files. It specifically identifies when these files are created by processes associated with scheduling mechanisms like 'cron' or 'scheduler', or triggered by a 'heartbeat' event, which is potentially indicative of adversary data collection or staging activity.
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
Page 90 of 217