Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects instances where a file named 'config.txt' is created, modified, or renamed. This pattern is commonly used by attackers to stage configuration files, drop payloads, or modify application settings.
Detects access or creation of sensitive browser-related files such as cookies, login data, and preferences within identified backup directories for Google Chrome and Microsoft Edge. This activity is often associated with credential theft or data staging for later exfiltration.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
This rule monitors for the creation of files containing the string 'readme_ransom' or the execution of processes that reference 'readme_ransom', specific known ransomware wallet addresses, or associated contact email addresses, which are indicative of post-encryption ransomware activity.
This rule detects a multi-stage attack chain associated with the SnappyClient RAT (Operation Turb00). The detection logic correlates: 1. Execution of known malicious processes (AlphVector, WizardDa42, VirtualAr, or Crisp); 2. Persistence mechanisms including specific registry keys (CadenceOptimizer) or file artifacts (shortcut links, scheduled tasks, Mayanex data dir, or CorsairUtil DLL); and 3. Outbound network traffic on ports 3333 or 3334 to external IP addresses.
This rule monitors for two indicators of potential ransomware activity: first, a surge in file renaming or creation events across multiple directories within a short window, suggesting large-scale encryption; second, the creation of potential ransom note files across multiple directories or devices. It uses Microsoft Defender for Endpoint data to identify these patterns as part of an incident response strategy.
Detects large outbound network transmissions occurring on a host shortly after the creation of staged or archive files. This behavior is indicative of an attacker consolidating sensitive data (such as credentials or intelligence) into an archive and subsequently exfiltrating it over a Command and Control (C2) or other established network channel.
Detects the creation or presence of a file named 'svehost.exe' (a common typo-squat for 'svchost.exe') within the 'C:\Users\Public\AppData\Windows' directory. This behavior is indicative of an adversary attempting to masquerade a malicious executable by mimicking a legitimate Windows service process name and placing it in a non-standard, often-abused location.
This rule detects suspicious activity associated with the Cavern Manticore threat group, specifically the loading of the 'mhm.dll' module followed by the creation of archive files (.zip, .rar, .7z) within one hour by the same process. This behavior is indicative of data staging for exfiltration, potentially involving DPAPI-protected data.
Detects zip archives matching the .zx_ filename prefix convention used by CrashStealer to stage encrypted exfiltration data in /tmp prior to transmission to its C2 server.
Detects the creation of BMP files within the Temp directory containing the pattern 'wallpaper_', which is a behavior consistent with LIUSHEN ransomware modifying the desktop background to display a ransom note.
Detects PamStealer's embedded helper binary dropped to /private/tmp/System Settings and used to establish legacy login item persistence via osascript System Events
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
Detects access to sensitive browser internal pages (profile-internals) via command line or the generation of error PDF files, which may indicate browser-based reconnaissance, credential harvesting, or data exfiltration attempts.
Detects the legitimate WinDirStat.exe binary loading a malicious uxtheme.dll from a non-standard directory (C:\ProgramData\WinDir\). This pattern is consistent with DLL side-loading techniques, specifically those associated with the SysAid update supply chain compromise.
Detects the creation or modification of Fortinet VPN-related configuration, command, or script files on a system. Attackers may target these files to gain unauthorized access, modify VPN parameters, or extract sensitive connection information.
Detects anomalous process behavior potentially related to the RoguePlanet exploit or Poseidon-like thread I/O saturation techniques. This rule identifies processes performing high-frequency file creation in the system temporary directory using UUID-formatted filenames while simultaneously spawning a large number of threads, a pattern often used to widen race conditions for Time-of-Check Time-of-Use (TOCTOU) exploitation.
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Detects the creation or modification of Windows Registry Run keys or the addition of files into the startup directory. These are common persistence mechanisms used by adversaries to ensure programs execute automatically upon system boot or user logon.
Page 92 of 217