Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects access, creation, or modification of sensitive browser files (Cookies, Login Data, Local State) associated with Google Chrome or Microsoft Edge. The rule specifically flags when these files are interacted with within standard user directories or when they are copied to known browser backup folders, a common behavior during credential theft or data staging.
Detects Node.js processes generating text or log files containing diagnostic markers related to network activity monitoring, such as 'Network Connection Dump Snapshot' or 'Monitoring active egress sockets'. This behavior is characteristic of custom tool execution used for network discovery and data collection on a host.
This rule detects potential ransomware activity or bulk file manipulation by monitoring for a high volume of file write, rename, or creation events performed by a single process within a one-minute window. It calculates the frequency and variety of unique files touched to identify potentially malicious automated encryption or data destruction behavior.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects execution or file activity associated with 'nvidia-sysruntime.exe', a known masquerading file name used by LabubaRAT, which often performs unauthorized archiving or staging of data.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
Detects instances where a process creates, renames, or copies a file into the /Library/Caches/ directory where the resulting file's SHA256 hash matches the SHA256 hash of the initiating process. This behavior suggests a binary or script is creating a copy of itself within a writable system cache directory, a common technique for establishing persistence or running code from a less conspicuous location.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects high-volume file creation events (more than 50 within 5 minutes) on an endpoint using specific file extensions associated with known ransomware families such as INC Ransom (.inc) and Lynx (.lynx).
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Detects potential screenshot activity by monitoring the creation and subsequent deletion of .png image files by the pythonw.exe process, a pattern observed in Starland RAT post-compromise activity.
Detects the execution of csc.exe (the C# command-line compiler) with specific command-line arguments (/noconfig, /fullpaths) and a response file (.cmdline) located within a temporary directory. This pattern is commonly associated with fileless malware, such as Banana RAT, which compiles its components at runtime to bypass static file-based detection.
Detects build process content (likely within a Dockerfile or CI/CD script) that installs 'netcat' and initiates a multi-architecture build and push operation to a specific container registry path (registryfr.azurecr.io/mongo:latest), which may indicate the creation of a backdoored or malicious container image.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
Detects persistence attempts by monitoring modifications to Windows 'Run' registry keys, the creation of executable files (.exe, .lnk) within the user's startup directory, or the use of common command-line utilities (reg.exe, powershell.exe) to modify these autostart persistence locations.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
Detects the creation of working directories in temporary locations matching the RoguePlanet exploit staging pattern, specifically associated with CVE-2026-50656 (Nightmare Eclipse). The rule identifies the creation of directories containing fake System32 subdirectories or suspicious files (wermgr.exe) used in a TOCTOU (Time-of-Check Time-of-Use) exploit chain against MsMpEng.exe.
Detects instances where a file named 'config.txt' is created, modified, or renamed. This pattern is commonly used by attackers to stage configuration files, drop payloads, or modify application settings.
Detects access or creation of sensitive browser-related files such as cookies, login data, and preferences within identified backup directories for Google Chrome and Microsoft Edge. This activity is often associated with credential theft or data staging for later exfiltration.
Page 91 of 217